---
id: "CVE-2026-97854"
kind: "vulnerability"
aliases: ["CVE-2026-97854"]
title: "Yamaha NWR100 wireless router: crafted request runs arbitrary OS commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NWR100", "fixed": ["Rev.26.00.08"], "affected": "<= Rev.26.00.07", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "network-gear", "nwr100", "self-hosted", "wireless-router", "yamaha"]
not_affected_if: ["firmware-rev-26.00.08-or-later", "no-nwr100-deployed", "web-gui-not-reachable-by-attacker"]
published_at: "2026-10-29T12:17:14+00:00"
first_seen_at: "2026-10-29T12:24:39+00:00"
updated_at: "2026-10-29T12:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97854", "first_seen_at": "2026-10-29T12:24:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:26:53+00:00"}]
---

# Yamaha NWR100 wireless router: crafted request runs arbitrary OS commands

The Yamaha NWR100 wireless LAN router has an OS command injection flaw. A specially crafted request sent to the device can make it execute arbitrary operating system commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NWR100 affected <= Rev.26.00.07 fixed Rev.26.00.08

## How to check

- In the NWR100 Web GUI, check the firmware revision. Rev.26.00.07 or earlier is affected; Rev.26.00.08 is fixed.
- Check whether the Web GUI is reachable from the internet (opened ports or port forwarding) and which LAN/Wi-Fi clients can reach it.

## Fix

Update NWR100 firmware to Rev.26.00.08 or later. If you cannot update, restrict which devices and source IPs can reach the Web GUI (IP filter and Web GUI access-management settings).

## Timeline

- 2026-10-29T12:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97854
- 2026-10-29T12:26:53+00:00 analyst — Read Yamaha's own FAQ (rtpro.yamaha.co.jp) and JVN: NWR100 Rev.26.00.07 and earlier affected, fixed in Rev.26.00.08. Vendor workaround: restrict Web GUI access with IP filter and Web GUI access-management settings. Web GUI not internet-reachable by default; exposed if ports opened or from LAN/Wi-Fi clients. No exploitation or PoC found; no social search done (new advisory).

## Documents

- [advisory] Yamaha: JVNVU#91027179 NWR100 vulnerabilities http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html
- [advisory] JVNVU#91027179 Multiple vulnerabilities in Yamaha router NWR100 https://jvn.jp/en/vu/JVNVU91027179/

## From the sources

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_