This vulnerability (CVE-2025-41275) affects Waterfall WF-500 TX and RX Hosts running version 7.9.1.0 R2502171040. It is an OS command injection flaw (CWE-78) in the Console WebUI that permits remote attackers to execute arbitrary OS commands without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor. The vulnerability was publicly disclosed by Nozomi Networks Labs.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on affected Waterfall WF-500 devices. This can lead to full compromise of the device, including unauthorized access, data manipulation, and disruption of device functionality. The critical CVSS score of 9.3 reflects the severity and potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Console WebUI to trusted users only and consider additional network-level controls to limit exposure. Monitor vendor communications closely for patch announcements and apply updates promptly once available.