CVE-2025-41276
Published: 29 May 2026
Summary
CVE-2025-41276 is a critical-severity OS Command Injection (CWE-78) vulnerability in Waterfall-Security Wf-500 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 31.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-41276 is an OS command injection vulnerability (CWE-78) discovered by Nozomi Networks Labs in the Console WebUI of Waterfall WF-500 TX and RX Hosts running version 7.9.1.0 R2502171040. The flaw permits improper neutralization of special elements in operating system commands, enabling direct execution of arbitrary commands on the underlying device.
Remote unauthenticated attackers can exploit the issue over the network without any user interaction or credentials. Successful exploitation grants full control over the affected host, allowing arbitrary operating system command execution that can compromise confidentiality, integrity, and availability of the device.
The vendor advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41276 provides details on the flaw and is the primary source for mitigation guidance, including any available patches or configuration changes for the WF-500 platform.
EPSS scores for the CVE rose from a low baseline to a peak of 0.0102, indicating emerging exploitation interest after disclosure that warrants renewed attention from defenders.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209996
Vulnerability details
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to…
more
execute arbitrary operating system commands on the device.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all WebUI inputs to block the special characters that enable OS command injection (CWE-78).
Enforces authentication and authorization checks before any WebUI request is processed, eliminating the unauthenticated attack vector described in the CVE.
Restricts network traffic to the WF-500 Console WebUI, limiting remote unauthenticated access that would otherwise allow command execution.