CVE-2025-41280: Waterfall WF-500 Path Traversal Flaw

CVE-2025-41280 Overview

CVE-2025-41280 is a relative path traversal vulnerability [CWE-23], commonly known as Zip Slip, affecting the Waterfall Security WF-500 RX Host firmware version 7.9.1.0 R2502171040. Nozomi Networks Labs identified the flaw, which allows an attacker with access to the TX Host to execute code on the RX Host. Exploitation requires a specific configuration where a MySQL connector is in use and file compression is enabled. The WF-500 is a unidirectional gateway deployed in operational technology (OT) and industrial environments to enforce one-way data transfer between segmented networks.

Critical Impact
An attacker positioned on the TX Host can leverage the Zip Slip flaw to write files outside the intended extraction directory on the RX Host, leading to arbitrary code execution and compromise of the high-trust receiving network.

Affected Products

Waterfall Security WF-500 (hardware)
Waterfall Security WF-500 firmware version 7.9.1.0 R2502171040
WF-500 deployments with MySQL connector configured and file compression enabled

Discovery Timeline

Vulnerability discovered and reported by Nozomi Networks Labs
2026-05-29 - CVE-2025-41280 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2025-41280

Vulnerability Analysis

The WF-500 transfers data from a TX Host to an RX Host over a unidirectional link. When the MySQL connector is configured with file compression enabled, archived files generated on the TX side are decompressed on the RX side. The RX Host extraction routine does not properly validate entry names contained within the archive. An attacker who controls archive contents on the TX Host can craft entries with relative path components such as ../ to escape the intended extraction directory.

Writing to attacker-chosen filesystem locations on the RX Host enables overwriting of executables, scripts, or configuration files. This converts a file-write primitive into code execution on the receiving segment. The attack requires local access to the TX Host but no authentication on the RX side, since the unidirectional channel implicitly trusts inbound data.

Root Cause

The root cause is missing canonicalization and validation of archive entry paths during decompression on the RX Host. The extraction code concatenates the destination directory with the entry name without verifying that the resolved path remains within the target directory. This is the canonical Zip Slip pattern documented under CWE-23: Relative Path Traversal.

Attack Vector

The attack vector is local with respect to the WF-500 deployment, requiring access to the TX Host. An adversary who has already compromised the lower-trust source network constructs a malicious archive containing entries with traversal sequences. When the MySQL connector forwards the compressed payload across the unidirectional link, the RX Host extracts the archive and writes files to attacker-controlled paths. Subsequent execution of an overwritten binary or scheduled task on the RX Host completes the chain. Refer to the Nozomi Networks Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2025-41280

Indicators of Compromise

Archive files transferred via the MySQL connector containing entry names with ../ sequences or absolute paths
Unexpected file writes on the RX Host outside the configured extraction directory
Modified system binaries, cron jobs, or service unit files on the RX Host with recent timestamps correlating to TX-side transfers
New or modified executables in paths such as /etc/, /usr/local/bin/, or service startup directories on the RX Host

Detection Strategies

Inspect MySQL connector archive payloads at the TX Host for entries whose canonicalized paths escape the extraction root
Enable filesystem integrity monitoring on the RX Host for system directories and connector working directories
Correlate decompression events with subsequent process execution and file creation outside expected paths
Audit WF-500 configuration to identify deployments with both the MySQL connector active and file compression enabled

Monitoring Recommendations

Forward RX Host filesystem and process telemetry to a centralized analytics platform for anomaly identification
Alert on writes by the decompression process to paths outside its designated working directory
Track integrity hashes of executables and scripts on the RX Host and alert on unexpected changes
Review TX Host access logs for unauthorized users or processes producing archives consumed by the MySQL connector

How to Mitigate CVE-2025-41280

Immediate Actions Required

Identify all WF-500 deployments running firmware 7.9.1.0 R2502171040 and inventory connector configurations
Disable file compression on the MySQL connector where operationally feasible until a patched firmware is applied
Restrict and audit access to the TX Host so that only trusted processes and accounts can stage archive content
Contact Waterfall Security for vendor guidance and apply patched firmware as soon as it is published

Patch Information

Refer to the Nozomi Networks Vulnerability Advisory and coordinate directly with Waterfall Security for firmware updates that address the path traversal in the RX Host decompression routine. No public patch identifier was listed in the NVD entry at the time of publication.

Workarounds

Disable the MySQL connector if it is not required for production data flows
Disable file compression for the MySQL connector to remove the vulnerable extraction code path
Apply strict allowlisting on the TX Host for source systems that can submit data to the connector
Segment and monitor the RX Host network so that any code execution attempt is contained and observable

bash

# Configuration example - inventory and harden WF-500 connector exposure
# 1. Identify affected firmware version on each WF-500 appliance
#    (run from a management workstation with appliance CLI access)
# Expected vulnerable build: 7.9.1.0 R2502171040

# 2. On the TX Host, restrict who can place files into the MySQL connector spool
chown root:waterfall /var/spool/wf500/mysql
chmod 750 /var/spool/wf500/mysql

# 3. Disable file compression on the MySQL connector (consult vendor docs for exact key)
#    Example placeholder - replace with vendor-supplied configuration path
# wf500-cli connector set mysql compression=disabled

# 4. Enable filesystem integrity monitoring on the RX Host for sensitive paths
auditctl -w /usr/local/bin -p wa -k wf500_rx_integrity
auditctl -w /etc/systemd/system -p wa -k wf500_rx_integrity