CVE-2025-41281: Waterfall WF-500 Firmware RCE Vulnerability

CVE-2025-41281 Overview

CVE-2025-41281 is an OS command injection vulnerability [CWE-78] in the Waterfall Security WF-500 unidirectional security gateway. The flaw exists in the RX Host component of firmware version 7.9.1.0 R2502171040 when a MySQL connector is configured. Attackers with access to the TX Host can inject commands that execute on the RX Host, breaking the one-way data flow assumption that defines the device's security model. Nozomi Networks Labs identified and disclosed the vulnerability to the vendor.

Critical Impact
An attacker on the TX side can execute arbitrary OS commands on the RX Host, undermining the unidirectional isolation between operational technology networks and external systems.

Affected Products

Waterfall Security WF-500 hardware appliance
Waterfall Security WF-500 firmware version 7.9.1.0 R2502171040
WF-500 deployments configured with the MySQL connector

Discovery Timeline

Vulnerability identified by Nozomi Networks Labs
2026-05-29 - CVE-2025-41281 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2025-41281

Vulnerability Analysis

The Waterfall WF-500 enforces unidirectional data flow between a Transmit (TX) Host and a Receive (RX) Host, a design used to protect industrial control system networks from external interference. Connectors translate application-layer protocols across this hardware data diode. The MySQL connector on the RX Host fails to sanitize input received from the TX Host before passing it to an OS command interpreter. An attacker controlling the TX side can embed shell metacharacters into MySQL connector traffic, which the RX Host then executes with the privileges of the connector process.

The vulnerability category is OS command injection, classified as [CWE-78]: Improper Neutralization of Special Elements used in an OS Command. The local attack vector reflects that exploitation requires prior access to the TX Host rather than direct network exposure of the RX side.

Root Cause

The RX Host's MySQL connector concatenates attacker-influenced strings into commands passed to a shell or exec-style API without escaping or argument-array separation. Because the unidirectional gateway design treats the TX side as the lower-trust origin, input from TX should be parsed as data only. The connector instead reaches the RX command execution path with that data still embedded in a command string.

Attack Vector

Exploitation requires the attacker to first compromise or control a system communicating through the TX Host with the MySQL connector active. The attacker crafts MySQL traffic containing shell metacharacters such as backticks, semicolons, or $() constructs. When the RX Host processes the connector payload, the injected fragment is executed by the underlying operating system. The result is code execution on the RX Host, the protected side of the data diode, with high impact on confidentiality, integrity, and availability of the RX environment. No verified public proof-of-concept is available. Refer to the Nozomi Networks Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2025-41281

Indicators of Compromise

Unexpected child processes spawned by the MySQL connector service on the RX Host
Shell interpreters such as /bin/sh or /bin/bash invoked from connector context
Outbound or lateral connections originating from the RX Host after connector activity
Anomalous writes to system directories or new files in connector working paths

Detection Strategies

Baseline the expected process tree of the MySQL connector and alert on deviations
Inspect connector logs for MySQL payloads containing shell metacharacters such as ;, |, backticks, or $(
Correlate TX Host activity with RX Host process creation events through centralized log analysis
Apply [CWE-78] detection rules tuned to OS command injection patterns in application input

Monitoring Recommendations

Forward WF-500 RX Host audit logs to a SIEM for real-time inspection
Monitor for new listening sockets, cron entries, or persistence artifacts on the RX Host
Track integrity of connector binaries and configuration files with file integrity monitoring
Alert on any interactive shell session on the RX Host, which should never occur during normal operation

How to Mitigate CVE-2025-41281

Immediate Actions Required

Inventory all WF-500 appliances and identify those running firmware 7.9.1.0 R2502171040 with the MySQL connector enabled
Restrict and audit access to the TX Host, treating it as the prerequisite attack surface
Apply the vendor-supplied firmware update once available from Waterfall Security
Review RX Host logs for prior signs of command execution by the MySQL connector

Patch Information

Consult the Nozomi Networks Vulnerability Advisory and Waterfall Security support channels for the fixed firmware release. Coordinate the upgrade window with operational technology change-control procedures because the WF-500 typically sits in the path of critical industrial data flows.

Workarounds

Disable the MySQL connector on affected RX Hosts where the protocol is not strictly required
Limit which upstream systems can submit MySQL traffic through the TX Host using network segmentation and firewall rules
Enforce least-privilege accounts on databases reachable through the connector so that compromise of TX-side systems is harder to leverage
Increase monitoring on both TX and RX Hosts until the firmware patch is deployed