PT-2026-44803 · Waterfall · Wf-500 Tx Host

CVE-2025-41265 · Published 2026-05-29 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Waterfall WF-500 TX Host version 7.9.1.0 R2502171040

Description An OS Command Injection issue exists in the Administration WebUI, which allows remote authenticated attackers to execute arbitrary operating system commands on the host. OS Command Injection is a flaw where an application fails to properly neutralize special elements used in an OS command, allowing the execution of unintended commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-41265

Affected Products

Wf-500 Tx Host

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41265 · Security Note
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-41265 · Vendor Advisory
• https://twitter.com/DFIR_Lab/status/2061603007427490167 · Twitter Post
• https://t.me/cveNotify/165185 · Telegram Post
• https://twitter.com/dailycve/status/2061585336745025754 · Twitter Post