# CVE-2025-41268: Waterfall WF-500 path traversal in Administration WebUI

Source: https://junglewise.ai/threats/cve-2025-41268-waterfall-wf-500-path-traversal-in-administration-webui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2025-41268 · Severity: info · CVSS 8.8 · Published 2026-05-29

A security vulnerability has been identified in the Waterfall WF-500 Unidirectional Security Gateway, a device used to protect industrial control systems by allowing data to flow in only one direction. An attacker can remotely delete critical system files without needing a username or password. This could lead to a complete shutdown of the gateway, disrupting the secure flow of data between industrial networks and corporate environments.

Technologies: [Waterfall Security Solutions WF-500 RX Host](https://junglewise.ai/threats/technologies/wf-500-rx-host), [Waterfall Security Solutions WF-500 TX Host](https://junglewise.ai/threats/technologies/wf-500-tx-host). Vendors: [Waterfall Security Solutions](https://junglewise.ai/threats/vendors/waterfall-security-solutions).

## Quick answers

**Is CVE-2025-41268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-41268 being exploited in the wild.

**How severe is CVE-2025-41268?** Informational severity, with a CVSS score of 8.8, published 29 May 2026.

**Which products and versions are affected?** Waterfall Security Solutions WF-500 RX Host 7.9.1.0 R2502171040; Waterfall Security Solutions WF-500 TX Host 7.9.1.0 R2502171040.

**Is there a fix for CVE-2025-41268?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-41268 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-41268?** Check whether you run Waterfall Security Solutions WF-500 RX Host or Waterfall Security Solutions WF-500 TX Host at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Relative Path Traversal vulnerability (CWE-23) exists within the Administration WebUI of Waterfall WF-500 TX and RX Hosts. The flaw resides in how the web interface handles file paths, allowing an attacker to use special characters (such as '../') to bypass intended directory restrictions. This vulnerability is exploitable over the network without authentication or user interaction. A successful exploit allows a remote attacker to delete arbitrary files on the host operating system, potentially leading to a denial-of-service condition or system instability. The issue is confirmed in version 7.9.1.0 R2502171040.

## Affected products

- Waterfall Security Solutions WF-500 TX Host 7.9.1.0 R2502171040
- Waterfall Security Solutions WF-500 RX Host 7.9.1.0 R2502171040

## Timeline

- 2026-05-29: advisory: CVE published by Nozomi Networks Labs

## References

- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41268](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41268)

## Related threats

- [Waterfall WF-500 RX Host OS command injection in MySQL connector](https://junglewise.ai/threats/cve-2025-41281-waterfall-wf-500-rx-host-os-command-injection-in-mysql-connector)
- [Waterfall WF-500 RX Host path traversal in file compression handling](https://junglewise.ai/threats/cve-2025-41280-waterfall-wf-500-rx-host-path-traversal-in-file-compression)
- [Waterfall WF-500 RX Host OS command injection in Administration WebUI](https://junglewise.ai/threats/cve-2025-41279-waterfall-wf-500-rx-host-os-command-injection-in-administration)
- [Waterfall WF-500 RX Host out-of-bounds read code execution](https://junglewise.ai/threats/cve-2025-41278-waterfall-wf-500-rx-host-out-of-bounds-read-code-execution)
- [Waterfall WF-500 OS command injection in Console WebUI](https://junglewise.ai/threats/cve-2025-41277-waterfall-wf-500-os-command-injection-in-console-webui)