QSearchQSearch

CVE-2025-41279

7.2 HIGH

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in t...

Published: 2026-05-29 · Last updated: 2026-06-01

Severity and scoring

CVSS
7.2 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-78

Affected products

VendorProduct
waterfall-securitywf-500_firmware

Description

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 RX Host.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2025-41281 — Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in W... (7.8 HIGH)
  • CVE-2025-41280 — Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 t... (7.8 HIGH)
  • CVE-2025-41278 — Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows att... (7.8 HIGH)
  • CVE-2025-41277 — Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in t... (9.8 CRITICAL)
  • CVE-2025-41276 — Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in t... (9.8 CRITICAL)

Same CWE

  • CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
  • CVE-2026-42563 — Dulwich is a pure-Python implementation of the Git file formats and protocols
  • CVE-2026-0273 — A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrict...
  • CVE-2026-6893 — A flaw was found in dracut (8.8 HIGH)
  • CVE-2026-46643 — Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page