Home

Description

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

PUBLISHED Reserved 2025-04-16 | Published 2026-05-29 | Updated 2026-05-29 | Assigner Nozomi




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Product status

Default status
unaffected

Any version
affected

Credits

Luca Borzacchiello at Nozomi Networks finder

References

www.nozominetworks.com/...rability-advisories-cve-2025-41273 third-party-advisory

cve.org (CVE-2025-41273)

nvd.nist.gov (CVE-2025-41273)

Download JSON