PT-2026-44810 · Waterfall · Waterfall Wf-500 Tx+1

CVE-2025-41272 · Published 2026-05-29 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040

Description The Console WebUI contains an OS Command Injection issue, which occurs when special elements used in an OS command are not properly neutralized. This allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-41272

Affected Products

Waterfall Wf-500 Rx

Waterfall Wf-500 Tx

References · 4

• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-41272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41272 · Security Note
• https://twitter.com/dailycve/status/2061585553561161998 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2062800464731627688 · Twitter Post