This vulnerability involves improper neutralization of special elements used in OS commands within the Waterfall WF-500 RX Host software. Specifically, when a MySQL connector is configured, an attacker with access to the TX Host can execute arbitrary code on the RX Host by exploiting this OS command injection flaw. The issue affects version 7.9.1.0 R2502171040 of the product. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges required, but requires user interaction and partial attack complexity. The vulnerability impacts confidentiality, integrity, and availability with high impact metrics.

Successful exploitation allows an attacker with access to the TX Host to execute arbitrary code on the RX Host, potentially compromising the affected system's confidentiality, integrity, and availability. This could lead to unauthorized control or disruption of the RX Host environment. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the TX Host and carefully control configuration of the MySQL connector to reduce exposure. Monitor vendor communications for updates on patches or mitigations.