CVE-2025-41278: Waterfall WF-500 Firmware RCE Vulnerability

CVE-2025-41278 Overview

CVE-2025-41278 is an out-of-bounds read vulnerability [CWE-125] identified by Nozomi Networks Labs in the Waterfall WF-500 RX Host firmware version 7.10.0.0 R2601141040. The Waterfall WF-500 is a unidirectional security gateway used in operational technology (OT) environments to enforce one-way data flow between segmented networks. An attacker with access to the TX Host can leverage the flaw to execute code on the RX Host, undermining the segmentation guarantee the device provides.

Critical Impact

Attackers with TX Host access can execute arbitrary code on the RX Host, breaching the unidirectional trust boundary central to the WF-500's purpose.

Affected Products

• Waterfall Security WF-500 hardware appliance
• Waterfall Security WF-500 firmware version 7.10.0.0 R2601141040
• WF-500 deployments with the affected RX Host build

Discovery Timeline

• Vulnerability identified by Nozomi Networks Labs
• 2026-05-29 - CVE-2025-41278 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2025-41278

Vulnerability Analysis

The defect is classified under [CWE-125] Out-of-Bounds Read. The vulnerable code path on the RX Host reads memory beyond the bounds of an allocated buffer when processing data received from the TX Host. According to the Nozomi Networks advisory, this out-of-bounds read condition is reachable by an attacker who controls or has access to the TX Host and can be escalated into code execution on the RX Host. The Waterfall WF-500 is designed to permit data flow strictly from TX to RX, so a flaw that lets the TX side influence RX execution defeats the data diode security model. The CWE-125 root condition combined with the device's protocol parsing logic produces both a confidentiality impact (memory contents disclosure) and a code execution primitive on the receiving host.

Root Cause

The RX Host firmware fails to validate the length or offset of structured input received from the TX Host before performing a memory read. When attacker-influenced length or index fields exceed the size of the underlying buffer, the parser reads adjacent memory. Improper handling of the resulting data path enables an attacker to chain the disclosure into code execution on the RX Host.

Attack Vector

Exploitation requires local access to the TX Host of a WF-500 deployment. No authentication on the RX Host is required because the RX Host implicitly trusts framed input arriving from the TX side. The attacker sends crafted messages across the unidirectional link that trigger the out-of-bounds read on the RX Host and pivot to code execution. The EPSS score is 0.015% (percentile 3.38), reflecting low observed exploit activity. Refer to the Nozomi Networks Vulnerability Advisory for the technical write-up; no public proof-of-concept is available at this time.

Detection Methods for CVE-2025-41278

Indicators of Compromise

• Unexpected process execution or service restarts on the RX Host of a WF-500 appliance
• Anomalous or malformed frames observed traversing the TX-to-RX channel
• Unexplained configuration or log file changes on the RX Host that should be append-only
• Outbound connections initiated from the RX Host network segment that deviate from baseline

Detection Strategies

• Compare RX Host firmware build strings against the vulnerable version 7.10.0.0 R2601141040 during inventory sweeps
• Inspect WF-500 system logs for parser errors, segmentation faults, or watchdog-triggered restarts on the RX side
• Monitor for any administrative or shell activity originating from the TX Host toward the RX Host control plane

Monitoring Recommendations

• Forward WF-500 syslog output to a centralized SIEM and alert on crash, restart, and integrity events
• Baseline traffic volume and frame structure across the unidirectional link and alert on deviations
• Continuously inventory OT assets and flag any WF-500 still running the affected firmware build

How to Mitigate CVE-2025-41278

Immediate Actions Required

• Identify all WF-500 appliances running firmware 7.10.0.0 R2601141040 and prioritize them for remediation
• Contact Waterfall Security support to obtain fixed firmware and coordinate maintenance windows
• Restrict and audit administrative access to the TX Host, since exploitation requires that foothold
• Review TX Host endpoints for compromise indicators that could precede a pivot through the WF-500

Patch Information

Nozomi Networks Labs disclosed CVE-2025-41278 to Waterfall Security. Refer to the Nozomi Networks Vulnerability Advisory for vendor-coordinated fix details and apply the firmware version provided by Waterfall Security that supersedes 7.10.0.0 R2601141040.

Workarounds

• Harden the TX Host with strict access control lists and limit interactive logins to named administrators
• Place the TX Host behind a jump server with multi-factor authentication and session recording
• Apply application allowlisting on the TX Host to prevent execution of unauthorized tooling that could craft malicious frames
• Increase monitoring of the WF-500 RX Host for crashes or anomalous behavior until the patched firmware is deployed

# Configuration example: identify WF-500 RX Host firmware version
# Run from an authorized management station against the appliance
ssh admin@wf500-rx "show system firmware"
# Compare output to the vulnerable build: 7.10.0.0 R2601141040