This vulnerability is an out-of-bounds read (CWE-125) in the Waterfall WF-500 RX Host component, specifically in version 7.10.0.0 R2601141040. The flaw allows an attacker who has access to the TX Host to execute arbitrary code on the RX Host. The CVSS 4.0 vector indicates the attack requires local access (AV:L) with low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and partial attack and impact scope and high impact on confidentiality, integrity, and availability. No patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation can lead to arbitrary code execution on the RX Host from an attacker with access to the TX Host, potentially compromising the confidentiality, integrity, and availability of the affected system. This could allow attackers to manipulate or disrupt operations dependent on the WF-500 device. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the TX Host to trusted users only and monitor for suspicious activity related to the WF-500 device. Avoid exposing the TX Host to untrusted networks or users.