JVNVU#91027179
Multiple vulnerabilities in Yamaha router NWR100

Overview

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains multiple vulnerabilities.

Products Affected

• NWR100 firmware versions Rev.26.00.07 and earlier

Description

NWR100 provided by Yamaha Corporation contains multiple vulnerabilities listed below:

• OS Command Injection (CWE-78)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2026-97854
• Insecure Storage of Sensitive Information (CWE-922)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 7.1
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Base Score 6.5
  • CVE-2026-109822

Impact

• An arbitrary OS command may be executed by sending a specially crafted request to the affected product (CVE-2026-97854).
• Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker (CVE-2026-109822).

Solution

Update the Firmware
Update the firmware to the latest version according to the information provided by the developer.
The developer has released the following firmware version to fix the vulnerability:

• Rev.26.00.08

• Restrict access to the Web GUI by configuring access controls and source IP address filtering.