CVE-2025-41273 | Nozomi Networks Labs

A Note to our Customers and Partners in the Middle East

Summary

A CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

Impact

Allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

Issue Date

May 29, 2026

Affects

This issue affects Waterfall WF-500 up to and including v7.9.1.0 R2502171040

CVE Name

CVE-2025-41273

CVSS Details

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score

9.3

Solution

Update the hosts software to version v7.10.0.0 R2601141040

Mitigations

Acknowledgements

Luca Borzacchiello at Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more