CVE-2025-41273

Name: CVE-2025-41273
Creator: NVD / NIST
Published: 2026-05-29T12:16:23.69+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.3/10EPSS 0.41%

Last modified Jun 17, 2026

CVE-2025-41273 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.

Description

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0

9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.41%

32.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-288

Affected Software

Vendor	Product	Versions
Waterfall-Security	Wf-500 Firmware	<= 7.9.1.0_r2502171040

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41273Vendor Advisory

Timeline

Published: May 29, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-41273?

How severe is CVE-2025-41273?

CVE-2025-41273 has a CVSS score of 9.3/10 (CRITICAL severity). The EPSS model estimates a 0.41% probability of exploitation in the next 30 days.

How do I fix CVE-2025-41273?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-41273?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST