Live › vulnerability › CVE-2026-109822
The Yamaha NWR100 wireless LAN router stores sensitive information insecurely in configuration files created by its CONFIG export function. An unauthenticated attacker can read those exported configuration files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Anyone running a Yamaha NWR100 wireless LAN router on firmware Rev.26.00.07 or earlier. An unauthenticated attacker who can reach the Web GUI can read CONFIG files produced by the export function (user interaction is required per CVSS). Yamaha says internet exposure is possible if the Web GUI has been made reachable externally (e.g. ports opened). Other Yamaha routers are not affected; the same firmware also fixes the OS command injection CVE-2026-97854.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NWR100 | vendor | <= Rev.26.00.07 | Rev.26.00.08 |
Update NWR100 firmware to Rev.26.00.08 (affected: Rev.26.00.07 and earlier).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.
This page as .md · .json · in your agent: get_signal("CVE-2026-109822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.