Yamaha NWR100: OS command injection in web GUI request handling
Summary
The Yamaha NWR100 wireless LAN router firmware up to Rev.26.00.07 contains an OS command injection vulnerability (CWE-78). An attacker who sends a specially crafted request to the device can execute arbitrary OS commands without authentication. The web GUI must be reachable by the attacker, for example from a device on the LAN or Wi-Fi, because it is not exposed to the internet by default.
Affected
- Yamaha NWR100 firmware Rev.26.00.07 and earlier
- Other Yamaha routers, UTM appliances, wireless LAN access points and L2/L3 switches are not affected according to Yamaha
Fixed in
- Firmware Rev.26.00.08 (fixes CVE-2026-97854 and CVE-2026-109822)
Workaround
- Restrict access to the web GUI with access controls and source IP address filtering (vendor recommendation for devices that cannot be updated immediately)
- Remove port forwarding to the web GUI
- Change administrator credentials
Exploitation
- Not known to be exploited in the wild according to OffSeq
- VulDB reports no known exploit available
- No public proof of concept or CISA KEV listing found at the time of research
- CISA SSVC: exploitation none, automatable yes, technical impact total
Our recommendation
- Inventory all NWR100 devices and their firmware versions
- Upgrade affected devices to Rev.26.00.08 or later as a priority
- If an upgrade is delayed, disable remote and port-forwarded access to the web GUI and limit it to trusted LAN devices
- Check logs for unexpected administrator logins or configuration changes
- Recheck NVD, JVN and CISA KEV for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JPCERT/CC JVNVU#91027179 jvn.jp
- Yamaha RT Series Security FAQ (Japanese) www.rtpro.yamaha.co.jp
- VulDB CVE-2026-97854 vuldb.com
- OffSeq Radar CVE-2026-97854 radar.offseq.com
- Strix AI CVE-2026-97854 www.strix.ai
- ThreatInt CVE-2026-97854 cve.threatint.com
- The Hacker Wire CVE-2026-97854 www.thehackerwire.com
- WhatGotPwned whatgotpwned.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:28.
Original description (NVD)
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.