This vulnerability affects the Console WebUI component of Waterfall WF-500 TX and RX Hosts (version 7.9.1.0 R2502171040). It enables remote attackers to bypass authentication mechanisms by leveraging an alternate path or channel, classified under CWE-288. Successful exploitation grants attackers the ability to perform actions as authenticated users without valid credentials. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can remotely bypass authentication controls on the Console WebUI, gaining unauthorized access with the privileges of an authenticated user. This could lead to unauthorized configuration changes, data exposure, or disruption of device operations. The critical CVSS score reflects the severity and ease of exploitation without any required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Console WebUI to trusted administrators only and monitor for any unusual access attempts. Avoid exposing the affected interface to untrusted networks.