{"id":"CVE-2026-97854","kind":"vulnerability","aliases":["CVE-2026-97854"],"related":[],"title":"Yamaha NWR100 wireless router: crafted request runs arbitrary OS commands","description":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.","summary":"The Yamaha NWR100 wireless LAN router has an OS command injection flaw. A specially crafted request sent to the device can make it execute arbitrary operating system commands.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NWR100","fixed":["Rev.26.00.08"],"affected":"<= Rev.26.00.07","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","network-gear","nwr100","self-hosted","wireless-router","yamaha"],"not_affected_if":["firmware-rev-26.00.08-or-later","no-nwr100-deployed","web-gui-not-reachable-by-attacker"],"how_to_check":"- In the NWR100 Web GUI, check the firmware revision. Rev.26.00.07 or earlier is affected; Rev.26.00.08 is fixed.\n- Check whether the Web GUI is reachable from the internet (opened ports or port forwarding) and which LAN/Wi-Fi clients can reach it.","fix":"Update NWR100 firmware to Rev.26.00.08 or later. If you cannot update, restrict which devices and source IPs can reach the Web GUI (IP filter and Web GUI access-management settings).","status":"open","published_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","triaged_at":"2026-10-29T12:25:27+00:00","updated_at":"2026-10-29T12:26:53+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-29T12:25:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Yamaha NWR100 wireless router: crafted request runs arbitrary OS commands","impact":"high","summary":"The Yamaha NWR100 wireless LAN router has an OS command injection flaw. A specially crafted request sent to the device can make it execute arbitrary operating system commands.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["yamaha","nwr100","wireless-router","network-gear"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the router.","analyst_note":"Find the Yamaha advisory and affected firmware ranges, and whether the request is reachable from the internet or only the LAN; see https://nvd.nist.gov/vuln/detail/CVE-2026-97854","how_to_check":"- Check whether any Yamaha NWR100 wireless LAN router is deployed on your network, including its firmware version, which the sources do not specify: unknown\n- Confirm whether the device's management interface is reachable from the internet: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-nwr100-deployed"],"who_is_affected":"The sources describe only the product and the flaw: a crafted request sent to the NWR100 can run arbitrary OS commands. Any team running this router is potentially exposed; the sources do not state affected firmware versions, required settings, or whether the device must be reachable from outside the network. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000695,"input_tokens":4103,"output_tokens":569,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Yamaha advisory and affected firmware ranges, and whether the request is reachable from the internet or only the LAN; see https://nvd.nist.gov/vuln/detail/CVE-2026-97854","search":"'-2026':12A,15A '-97854':13A,16A 'affect':87C 'arbitrari':8A,54B,73C 'command':10A,39B,57B,70C,75C 'contain':67C 'corpor':66C 'craft':5A,44B,83C 'cve':11A,14A 'devic':49B 'execut':53B,78C 'flaw':41B 'gear':21B 'host':25B 'infrastructur':18B 'inject':40B,71C 'lan':34B,60C 'make':51B 'may':76C 'network':20B 'network-gear':19B 'nwr100':2A,17A,22B,32B,62C 'oper':55B 'os':9A,38B,69C,74C 'product':88C 'provid':63C 'request':6A,45B,84C 'router':4A,28B,35B,61C 'run':7A 'self':24B 'self-host':23B 'send':80C 'sent':46B 'special':43B,82C 'system':56B 'vulner':72C 'wireless':3A,27B,33B,59C 'wireless-rout':26B 'yamaha':1A,29B,31B,58C,65C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Yamaha NWR100 wireless LAN router on firmware Rev.26.00.07 or earlier. By default the Web GUI cannot be reached from the internet, so the router is exposed from outside only if you opened ports to the GUI. Any device on the LAN or Wi-Fi that can reach the GUI can attack it. Other Yamaha routers, UTM appliances, wireless access points and switches are not affected.","tier":"B","verified":{"fix":{"at":"2026-10-29T12:26:53Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/","run_id":1019},"products":{"at":"2026-10-29T12:26:53Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/","run_id":1019},"how_to_check":{"at":"2026-10-29T12:26:53Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/","run_id":1019},"who_affected":{"at":"2026-10-29T12:26:53Z","by":"analyst","doc":"https://jvn.jp/en/vu/JVNVU91027179/","run_id":1019}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97854","severity":null,"published_at":"2026-10-29T12:17:14+00:00","modified_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","fetched_at":"2026-10-29T12:24:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97854:1019","url":null,"severity":null,"published_at":"2026-10-29T12:26:53+00:00","modified_at":"2026-10-29T12:26:53+00:00","first_seen_at":"2026-10-29T12:26:53+00:00","fetched_at":"2026-10-29T12:26:53+00:00","note":"Read Yamaha's own FAQ (rtpro.yamaha.co.jp) and JVN: NWR100 Rev.26.00.07 and earlier affected, fixed in Rev.26.00.08. Vendor workaround: restrict Web GUI access with IP filter and Web GUI access-management settings. Web GUI not internet-reachable by default; exposed if ports opened or from LAN/Wi-Fi clients. No exploitation or PoC found; no social search done (new advisory)."}],"documents":[{"id":16411,"url":"http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html","title":"Yamaha: JVNVU#91027179 NWR100 vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16412,"url":"https://jvn.jp/en/vu/JVNVU91027179/","title":"JVNVU#91027179 Multiple vulnerabilities in Yamaha router NWR100","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}