This vulnerability, tracked as CVE-2025-41268, involves a relative path traversal flaw (CWE-23) in the Administration WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. It enables remote attackers without authentication to delete arbitrary files on the host system. The CVSS 4.0 base score is 8.8, reflecting network attack vector, no required privileges or user interaction, and high impact on integrity and availability. No patch or official remediation level has been disclosed by the vendor. The vulnerability was identified and published by Nozomi Networks Labs.

Successful exploitation allows unauthenticated remote attackers to delete arbitrary files on the host machines running the vulnerable Waterfall WF-500 Administration WebUI. This can lead to denial of service or disruption of critical functions by removing essential files. The integrity and availability of the affected systems are severely impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, organizations should monitor vendor communications closely. Until a patch is available, restricting network access to the Administration WebUI and implementing compensating controls to limit exposure may reduce risk.