CVE-2025-41274
A critical flaw in Nozomi Networks’ Waterfall WF‑500 console web interface allows attackers to run arbitrary operating‑system commands on the device. The vulnerability exists in firmware version 7.9.1.0 R2502171040 and can be exploited without any authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Nozomi Networks Waterfall WF‑500 TX and RX hosts running firmware 7.9.1.0 R2502171040 (CPE: waterfall-security wf-500_firmware).
Real-world impact
An attacker who can reach the console web UI can execute any command on the device’s operating system, potentially taking full control, exfiltrating data, or disrupting network operations.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact: it allows remote, unauthenticated attackers to execute arbitrary commands with full system privileges, without needing to bypass authentication or user interaction.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- nozominetworks.com/labs/vulnerability-advisori…vendor advisory