CVE-2025-41268
Published: 29 May 2026
Summary
CVE-2025-41268 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Waterfall-Security Wf-500 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-41268 is a relative path traversal vulnerability (CWE-23) in the Administration WebUI of Waterfall WF-500 TX and RX Hosts running version 7.9.1.0 R2502171040. The flaw was identified by Nozomi Networks Labs and permits unauthorized file operations on the affected host systems.
Remote unauthenticated attackers can exploit the issue over the network to delete arbitrary files on the TX and RX host machines. The vulnerability carries a CVSS 4.0 score of 8.8, reflecting high impact on integrity and availability with no required authentication or user interaction.
Details and any associated guidance are published in the Nozomi Networks Labs advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41268. The associated EPSS score remains low, with a current value of 0.0110 and a peak of 0.0138.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209988
Vulnerability details
Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the Host machines.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations on the Administration WebUI so that unauthenticated remote actors cannot perform arbitrary file-delete operations.
Requires validation of user-supplied path input, directly blocking the relative path traversal (CWE-23) that enables deletion of arbitrary files.
Limits privileges of any authenticated WebUI sessions so that even if traversal succeeds the resulting file operations remain constrained to the minimal necessary set.