This vulnerability involves improper neutralization of special elements in OS commands within the Console WebUI of Waterfall WF-500 devices (TX and RX Hosts) running version 7.9.1.0 R2502171040. It enables remote attackers without authentication to execute arbitrary OS commands, posing a critical security risk. The CVSS 4.0 base score is 9.3, reflecting high exploitability and impact. The vendor has not yet released an official fix or provided remediation guidance. The vulnerability was identified and published by Nozomi Networks Labs.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected Waterfall WF-500 devices, potentially leading to full system compromise. This can result in unauthorized control over the device, data breach, disruption of operations, or further network penetration. The high CVSS score indicates severe impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Console WebUI to trusted administrators only and monitor for any unusual activity. Avoid exposing the affected devices directly to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.