Published:2026/10/28  Last Updated:2026/10/28

JVN#30675482
Yamaha YMS-VPN8 and YMS-VPN8-CP register Windows services with unquoted file paths

Overview

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths.

Products Affected

  • YMS-VPN8 versions Ver.1.04.00 and earlier
  • YMS-VPN8-CP versions Ver.1.04.00 and earlier

Description

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation contain the following vulnerability:

  • Unquoted search path or element (CWE-428)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
    • CVE-2026-97860

Impact

A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions to fix the vulnerability:

  • YMS-VPN8 Ver.1.07.00
  • YMS-VPN8-CP Ver.1.07.00
Apply the Workaround
The developer recommends the following mitigations for users who cannot update the software:
  • Do not share the Windows PC with other users.
  • Do not allow untrusted users to log in.
  • Do not grant administrative privileges to users who do not require them.
  • Do not execute files or programs from unknown or untrusted sources.

Vendor Status

Vendor Link
Yamaha Corporation Yamaha YMS-VPN8 and YMS-VPN8-CP register Windows services with unquoted file paths (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-97860
JVN iPedia