Nozomi Networks Labs identified a CWE-78 OS command injection vulnerability in the Console WebUI of Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040. This vulnerability allows remote unauthenticated attackers to execute arbitrary OS commands on the device, posing a critical security risk. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been published by the vendor, and the device is not a cloud service. No exploits are currently known in the wild.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected Waterfall WF-500 devices, potentially leading to full compromise of the device, including unauthorized access, data manipulation, or disruption of service. The critical CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Console WebUI to trusted administrators only and monitor for unusual activity. Avoid exposing the affected devices directly to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.