CVE-2026-97854

CriticalCVSS 9.8

Published: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

The Yamaha NWR100 wireless LAN router contains an OS command injection vulnerability that allows arbitrary OS commands to be executed by sending a specially crafted request to the device.

Risk Assessment

An attacker could take control of the router and execute system commands, potentially leading to full compromise of the device and network.

Recommendation

Update the router firmware to the latest version and consider restricting access to the management interface.

Other vulnerabilities in Yamaha NWR100

CVE-2026-109822Medium
The Yamaha NWR100 wireless LAN router contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.

Original NVD description (English source)

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS