PT-2026-44806 · Waterfall · Wf-500 Tx/Rx Hosts

CVE-2025-41268 · Published 2026-05-29 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040

Description A relative path traversal issue exists in the Administration WebUI. This allows remote unauthenticated attackers to delete arbitrary files on the host machines. Relative path traversal is a technique where an attacker uses special characters, such as dot-dot-slash (../), to access files and directories outside the intended folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-41268

Affected Products

Wf-500 Tx/Rx Hosts

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41268 · Security Note
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-41268 · Vendor Advisory
• https://twitter.com/DFIR_Lab/status/2061618104715591868 · Twitter Post
• https://t.me/cveNotify/165188 · Telegram Post