Live › vulnerability › CVE-2026-97854
The Yamaha NWR100 wireless LAN router has an OS command injection flaw. A specially crafted request sent to the device can make it execute arbitrary operating system commands.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Anyone running a Yamaha NWR100 wireless LAN router on firmware Rev.26.00.07 or earlier. By default the Web GUI cannot be reached from the internet, so the router is exposed from outside only if you opened ports to the GUI. Any device on the LAN or Wi-Fi that can reach the GUI can attack it. Other Yamaha routers, UTM appliances, wireless access points and switches are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NWR100 | vendor | <= Rev.26.00.07 | Rev.26.00.08 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-97854")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.