---
id: "CVE-2026-109822"
kind: "vulnerability"
aliases: ["CVE-2026-109822"]
title: "Yamaha NWR100 router: exported config files readable without login"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NWR100", "fixed": ["Rev.26.00.08"], "affected": "<= Rev.26.00.07", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "network-gear", "nwr100", "self-hosted", "wireless-router", "yamaha"]
not_affected_if: ["firmware-26.00.08-or-later", "not-nwr100", "web-gui-not-exposed"]
published_at: "2026-10-29T12:17:09+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:27:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109822", "first_seen_at": "2026-10-29T12:24:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:27:47+00:00"}]
---

# Yamaha NWR100 router: exported config files readable without login

The Yamaha NWR100 wireless LAN router stores sensitive information insecurely in configuration files created by its CONFIG export function. An unauthenticated attacker can read those exported configuration files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NWR100 affected <= Rev.26.00.07 fixed Rev.26.00.08

## How to check

- In the NWR100 Web GUI, check the firmware revision; Rev.26.00.07 or earlier is affected, Rev.26.00.08 is fixed.
- Check whether the Web GUI is reachable from the internet or untrusted networks (opened ports, IP filter / Web GUI access management).

## Fix

Update NWR100 firmware to Rev.26.00.08 (affected: Rev.26.00.07 and earlier).

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109822
- 2026-10-29T12:27:47+00:00 analyst — Yamaha FAQ and JVNVU#91027179 confirm affected <= Rev.26.00.07, fixed Rev.26.00.08. Workaround: restrict Web GUI access via IP filter/access management. Sibling CVE-2026-97854 (OS cmd injection, 9.8) in same advisory. No exploitation or PoC found; not searched on X.

## Documents

- [advisory] Yamaha: JVNVU#91027179 NWR100 vulnerabilities http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html
- [advisory] JVNVU#91027179: Multiple vulnerabilities in Yamaha router NWR100 https://jvn.jp/en/vu/JVNVU91027179/index.html

## From the sources

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_