This vulnerability (CVE-2025-41267) affects Waterfall WF-500 TX Host version 7.9.1.0, specifically its Administration WebUI. It is classified as CWE-78, indicating improper neutralization of special elements in OS commands, leading to OS command injection. Remote attackers with authenticated access and high privileges can execute arbitrary OS commands on the device. The CVSS 4.0 base score is 8.5, reflecting high impact and exploitability with network attack vector, low attack complexity, no attack or user interaction required beyond authentication, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor. The product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation allows remote authenticated attackers with high privileges to execute arbitrary operating system commands on the WF-500 TX Host. This can lead to full compromise of the affected device, impacting confidentiality, integrity, and availability of the system. The vulnerability poses a significant risk to environments using this product without mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, restrict administrative access to trusted personnel only and consider additional network-level controls to limit exposure of the Administration WebUI. Avoid using vulnerable versions in sensitive environments if possible.