{"id":"CVE-2026-109822","kind":"vulnerability","aliases":["CVE-2026-109822"],"related":[],"title":"Yamaha NWR100 router: exported config files readable without login","description":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.","summary":"The Yamaha NWR100 wireless LAN router stores sensitive information insecurely in configuration files created by its CONFIG export function. An unauthenticated attacker can read those exported configuration files.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NWR100","fixed":["Rev.26.00.08"],"affected":"<= Rev.26.00.07","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","network-gear","nwr100","self-hosted","wireless-router","yamaha"],"not_affected_if":["firmware-26.00.08-or-later","not-nwr100","web-gui-not-exposed"],"how_to_check":"- In the NWR100 Web GUI, check the firmware revision; Rev.26.00.07 or earlier is affected, Rev.26.00.08 is fixed.\n- Check whether the Web GUI is reachable from the internet or untrusted networks (opened ports, IP filter / Web GUI access management).","fix":"Update NWR100 firmware to Rev.26.00.08 (affected: Rev.26.00.07 and earlier).","status":"open","published_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:35+00:00","updated_at":"2026-10-29T12:27:47+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-29T12:25:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Yamaha NWR100 router: exported config files readable without login","impact":"medium","summary":"The Yamaha NWR100 wireless LAN router stores sensitive information insecurely in configuration files created by its CONFIG export function. An unauthenticated attacker can read those exported configuration files.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["yamaha","nwr100","wireless-router","network-gear"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Sensitive device configuration readable by unauthenticated attackers","analyst_note":"Check the Yamaha advisory and NVD entry for affected firmware versions, fixed versions and whether the attack needs LAN or internet access.","how_to_check":"- Check the router's firmware version in its admin interface; the sources do not name affected or fixed versions.\n- Confirm whether the router is an NWR100 model.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["not-nwr100"],"who_is_affected":"Owners of Yamaha NWR100 wireless LAN routers that use the CONFIG export function are affected, as the exported configuration files can be read without authentication. The sources do not say which firmware versions are affected or whether remote access is required. Teams without NWR100 devices can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4108,"output_tokens":538,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Yamaha advisory and NVD entry for affected firmware versions, fixed versions and whether the attack needs LAN or internet access.","search":"'-109822':12A,15A '-2026':11A,14A 'attack':50B,90C 'config':5A,45B,80C 'configur':40B,55B,75C 'contain':66C 'corpor':65C 'creat':42B 'cve':10A,13A 'export':4A,46B,54B,82C 'file':6A,41B,56B,76C,81C 'function':47B,83C 'gear':20B 'generat':77C 'host':24B 'inform':37B,74C 'infrastructur':17B 'insecur':38B,70C 'issu':68C 'lan':33B,59C 'login':9A 'may':84C 'network':19B 'network-gear':18B 'nwr100':2A,16A,21B,31B,61C 'provid':62C 'read':52B,86C 'readabl':7A 'router':3A,27B,34B,60C 'self':23B 'self-host':22B 'sensit':36B,73C 'storag':71C 'store':35B 'unauthent':49B,89C 'wireless':26B,32B,58C 'wireless-rout':25B 'without':8A 'yamaha':1A,28B,30B,57C,64C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Yamaha NWR100 wireless LAN router on firmware Rev.26.00.07 or earlier. An unauthenticated attacker who can reach the Web GUI can read CONFIG files produced by the export function (user interaction is required per CVSS). Yamaha says internet exposure is possible if the Web GUI has been made reachable externally (e.g. ports opened). Other Yamaha routers are not affected; the same firmware also fixes the OS command injection CVE-2026-97854.","tier":"B","verified":{"fix":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024},"products":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024},"mitigations":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024},"workarounds":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024},"how_to_check":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024},"who_affected":{"at":"2026-10-29T12:27:47Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/index.html","run_id":1024}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109822","severity":null,"published_at":"2026-10-29T12:17:09+00:00","modified_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109822:1024","url":null,"severity":null,"published_at":"2026-10-29T12:27:47+00:00","modified_at":"2026-10-29T12:27:47+00:00","first_seen_at":"2026-10-29T12:27:47+00:00","fetched_at":"2026-10-29T12:27:47+00:00","note":"Yamaha FAQ and JVNVU#91027179 confirm affected <= Rev.26.00.07, fixed Rev.26.00.08. Workaround: restrict Web GUI access via IP filter/access management. Sibling CVE-2026-97854 (OS cmd injection, 9.8) in same advisory. No exploitation or PoC found; not searched on X."}],"documents":[{"id":16411,"url":"http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html","title":"Yamaha: JVNVU#91027179 NWR100 vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16416,"url":"https://jvn.jp/en/vu/JVNVU91027179/index.html","title":"JVNVU#91027179: Multiple vulnerabilities in Yamaha router NWR100","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}