CVE-2025-41281

🗓️ 29 May 2026 11:00:16Reported by NozomiType

CVE-2025-41281: Waterfall WF-500 RX Host suffers OS command injection when a My SQL connector is configured and TX Host access exists.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2025-41281	29 May 202611:00	–	attackerkb
Circl	CVE-2025-41281	29 May 202613:53	–	circl
CNNVD	Waterfall WF-500 操作系统命令注入漏洞	29 May 202600:00	–	cnnvd
Cvelist	CVE-2025-41281	29 May 202611:00	–	cvelist
EUVD	EUVD-2025-210001	29 May 202611:00	–	euvd
NVD	CVE-2025-41281	29 May 202612:16	–	nvd
Positive Technologies	PT-2026-44819	29 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2025-41281	29 May 202611:00	–	vulnrichment

NVD

Node

waterfall-security wf-500_firmwareRange≤7.9.1.0_r2502171040

AND

waterfall-security wf-500Match-

[
  {
    "vendor": "Waterfall",
    "product": "WF-500",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "7.9.1.0 R2502171040",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
nozominetworks	www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41281

01 Jun 2026 18:55Current

6Medium risk

Vulners AI Score6

CVSS 3.17.8

CVSS 47.5

EPSS0.00044

SSVC

CWE-78

waterfall wf-500 rx host os command injection my sql connector tx host access