This vulnerability involves improper neutralization of special elements in OS commands within the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0. Authenticated attackers with high privileges can exploit this flaw to execute arbitrary OS commands remotely on the device. The issue is categorized under CWE-78 (OS Command Injection) and has a CVSS 4.0 base score of 8.6, indicating a high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows remote authenticated users with high privileges to execute arbitrary operating system commands on the WF-500 TX Host. This can lead to full compromise of the device, affecting confidentiality, integrity, and availability of the system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to command execution on the WF-500 TX Host. Avoid exposing the Administration WebUI to untrusted networks.