https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-41281.htmlhttps://patchthecve.com/cve/CVE-2025-41281.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is cohttps://patchthecve.com/cve/CVE-2025-41280.htmlhttps://patchthecve.com/cve/CVE-2025-41280.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.8: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled.https://patchthecve.com/cve/CVE-2025-41279.htmlhttps://patchthecve.com/cve/CVE-2025-41279.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.2: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating systemhttps://patchthecve.com/cve/CVE-2025-41278.htmlhttps://patchthecve.com/cve/CVE-2025-41278.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.8: Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackers with access to the TX Host to execute code on the RX Host.https://patchthecve.com/cve/CVE-2025-41277.htmlhttps://patchthecve.com/cve/CVE-2025-41277.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41276.htmlhttps://patchthecve.com/cve/CVE-2025-41276.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41275.htmlhttps://patchthecve.com/cve/CVE-2025-41275.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41274.htmlhttps://patchthecve.com/cve/CVE-2025-41274.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41273.htmlhttps://patchthecve.com/cve/CVE-2025-41273.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and performhttps://patchthecve.com/cve/CVE-2025-41272.htmlhttps://patchthecve.com/cve/CVE-2025-41272.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41271.htmlhttps://patchthecve.com/cve/CVE-2025-41271.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.5: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.https://patchthecve.com/cve/CVE-2025-41270.htmlhttps://patchthecve.com/cve/CVE-2025-41270.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41269.htmlhttps://patchthecve.com/cve/CVE-2025-41269.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.8: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating syshttps://patchthecve.com/cve/CVE-2025-41268.htmlhttps://patchthecve.com/cve/CVE-2025-41268.htmlTue, 21 Jul 2026 12:10:00 +0000CRITICAL 9.1: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the Host machines.https://patchthecve.com/cve/CVE-2025-41267.htmlhttps://patchthecve.com/cve/CVE-2025-41267.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.2: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating systemhttps://patchthecve.com/cve/CVE-2025-41266.htmlhttps://patchthecve.com/cve/CVE-2025-41266.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.2: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating systemhttps://patchthecve.com/cve/CVE-2025-41265.htmlhttps://patchthecve.com/cve/CVE-2025-41265.htmlTue, 21 Jul 2026 12:10:00 +0000HIGH 7.2: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system