Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CVE-2025-41270

AI Predicted 9.8 Difficulty: Easy EPSS 0.26% · P50

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProductVersion RangeStatus
WaterfallWF-500≤ 7.9.1.0 R2502171040affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-41270

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Waterfall WF-500 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Waterfall WF-500是以色列Waterfall公司的一个工业控制网络单向安全网关中的发送端主机组件。 Waterfall WF-500存在操作系统命令注入漏洞，该漏洞源于Console WebUI中OS命令注入，可能导致远程未经身份验证的攻击者在设备上执行任意操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
WaterfallWF-500 0 ~ 7.9.1.0 R2502171040 -

II. Public POCs for CVE-2025-41270

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-41270

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-41270 (1)

Same Patch Batch · Waterfall · 2026-05-29 · 17 CVEs total

CVE-2025-41275Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41277Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41281Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41279Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41265Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41269Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41268Waterfall WF-500 安全漏洞
CVE-2025-41272Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41276Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41271Waterfall WF-500 安全漏洞
CVE-2025-41266Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41280Waterfall WF-500 安全漏洞
CVE-2025-41273Waterfall WF-500 安全漏洞
CVE-2025-41267Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41274Waterfall WF-500 操作系统命令注入漏洞
CVE-2025-41278Waterfall WF-500 缓冲区错误漏洞

IV. Related Vulnerabilities

Same product: WF-500
Same vendor: Waterfall
Same weakness: CWE-78

V. Comments for CVE-2025-41270

No comments yet

Leave a comment