External risk intelligence

Waterfall WF-500 OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-41275

The vulnerability affects the WebUI of Waterfall WF-500 industrial security appliances. These devices are typically deployed as gateways or edge security components to manage data flow between networks, making their management interfaces or web services a common point of network-reachable surface in operational technology environments.

OS Command Injection

Waterfall Security Wf 500 Firmware

7.9.1.0_r2502171040 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Waterfall WF-500 devices, allowing unauthenticated attackers to remotely execute commands. This issue affects the device's management interface, potentially impacting the security and control of critical industrial operations.

Attackers can run commands remotely.
Affects industrial security devices.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted commands to the device's Console WebUI over the network. Since no authentication is required, an unauthenticated attacker can remotely access the web interface and inject operating system commands. Successful exploitation could allow an attacker to execute arbitrary commands on the device, potentially leading to a compromise of the system's integrity and availability.

Accessible via network without authentication.
Triggered by OS command injection in WebUI.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote, unauthenticated attackers to execute arbitrary operating system commands on affected Waterfall WF-500 devices when they access the Console WebUI.

Affected system commands could be executed.
Remote attackers may access the WebUI.
Compromise of device integrity is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical OS command injection vulnerability in the Waterfall WF-500 Console WebUI requires immediate attention from the platform or infrastructure team responsible for managing these industrial security appliances. The first actionable step is to identify all deployed WF-500 units, confirm their network exposure and business criticality, and then identify the accountable owner for remediation planning.

Platform or infrastructure team owns the issue.
Verify network exposure and asset criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Waterfall WF-500?

The Waterfall WF-500 is an industrial security appliance designed to manage data flow between network segments. These devices act as gateways or edge components, often sitting between sensitive operational technology environments and less secure networks to enforce unidirectional security policies, ensuring information can be monitored without compromising the control systems they protect.

What does OS command injection mean for CVE-2025-41275?

This vulnerability involves a weakness known as CWE-78, where an application fails to properly filter input before passing it to the operating system. In the context of CVE-2025-41275, the device's web console accepts user-provided input that is incorrectly treated as a command. This allows a remote user to append their own instructions, forcing the device to execute unauthorized actions at the system level rather than simply processing the intended interface request.

How is this vulnerability triggered?

An attacker triggers this issue by sending specially crafted inputs through the device's Console WebUI over the network. Because the interface fails to validate these inputs, it processes them as legitimate system-level commands. Note that this flaw specifically requires access to the web interface; requests directed at the underlying network traffic being managed by the appliance are not the trigger for this specific management-plane command injection.

Why should I worry about the network reachability of these devices?

Halo Surface Signal identifies this as a critical concern because the affected WebUI is often accessible over the network. If your WF-500 unit is reachable from broader network segments, an attacker does not need prior authentication to attempt these commands. Understanding whether your specific deployment exposes this management interface to the network is essential for evaluating your current risk level, as remote accessibility significantly increases the potential for unauthorized system interaction.

Do I need to take immediate action if I run these units?

Yes, you should begin by creating an inventory of all WF-500 appliances in your environment. Once identified, verify their network configuration to determine which are accessible and assess their business criticality to your operations. Engaging the team responsible for managing these industrial security assets is the next step to confirm the affected version and plan for the necessary updates or mitigation measures to secure the management interface.

References

www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41275

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.