Nozomi Networks Labs discovered a CWE-23 relative path traversal vulnerability in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. The issue arises when a MySQL connector is configured and file compression is enabled, allowing an attacker with access to the TX Host to perform Zip Slip attacks that lead to code execution on the RX Host. The CVSS 4.0 vector indicates the attack requires local access (AV:L), low complexity (AC:L), and no privileges or user interaction, with high impact on confidentiality, integrity, and availability. The vulnerability is published but lacks an official remediation level or patch from the vendor. The product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an attacker with access to the TX Host to execute arbitrary code on the RX Host, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized control over the RX Host environment. The vulnerability requires specific conditions (MySQL connector configured and file compression enabled) and local access to the TX Host. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the TX Host to trusted users only and consider disabling file compression or the MySQL connector if feasible to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.