CVE-2026-97854: Yamaha NWR100 Command Injection
Critical CVSS (9.8) reachable over network.
TL;DR - CVE-2026-97854 is a CVSS 9.8 unauthenticated OS command-injection flaw in Yamaha NWR100 firmware. - NWR100 Rev.26.00.07 and earlier are affected; upgrade to Rev.26.00.08. - No confirmed in-the-wild exploitation or public proof of concept was identified, but exposed Web GUI access should be restricted immediately.
Summary
CVE-2026-97854 is a critical Yamaha NWR100 vulnerability involving OS command injection. A remote attacker who can reach the device’s Web GUI may send a specially crafted request that causes the router to execute arbitrary operating-system commands. The vulnerability is tracked as CWE-78, Improper Neutralization of Special Elements used in an OS Command.
The risk comes from the combination of network reachability, the lack of authentication required in the CVSS assessment, and the potential impact to confidentiality, integrity, and availability. An exploited router could be reconfigured, disrupted, or used as a foothold for activity against other systems. Yamaha and JPCERT/CC identify Rev.26.00.08 as the fixed firmware release.
Organizations managing broader detection and response programs can also review our guide to comparing the best XDR platforms for additional monitoring context.
| Field | Assessment |
|---|---|
| CVE ID | CVE-2026-97854 |
| Product | Yamaha NWR100 wireless LAN router |
| CVSS v3.1 | 9.8 Critical |
| CVSS vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | Network |
| Authentication / privileges required | None in the CVSS assessment |
| User interaction | None |
| Patch available | Yes |
| Fixed version | NWR100 firmware Rev.26.00.08 |
| Affected versions | Rev.26.00.07 and earlier |
| CISA KEV status | Not listed at the time of checking |
The CVSS v4.0 assessment reported by JVN is 9.3: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CVSS is a severity measure, not a prediction that every deployment is exploitable from the public Internet. Actual exposure depends on Web GUI reachability, network segmentation, filtering, and device configuration.
Analyst’s Take: Patch this as a network-exposed management-plane issue, even though no confirmed exploitation or public proof of concept was identified. The first practical check is whether untrusted systems can reach the Web GUI; restrict that access immediately, then move affected devices to Rev.26.00.08.
Root Cause
The vulnerability is classified as OS command injection, or CWE-78. In practical terms, attacker-controlled input is handled in a way that permits data from a crafted Web GUI request to influence operating-system command execution. The available public advisory material does not identify the vulnerable endpoint, request parameter, command-construction function, or exact exploit string.
Because those implementation details have not been publicly disclosed in the supplied sources, defenders should avoid assuming that a particular URL, parameter, or vendor configuration is the only attack path. The reliable security boundary is the NWR100 Web GUI: any untrusted system able to reach that interface should be treated as a potential source of malicious requests until the firmware is updated.
Successful exploitation could permit arbitrary command execution, with consequences including configuration changes, service disruption, device compromise, and possible use of the router as a platform for further network activity. The separate configuration-file disclosure issue CVE-2026-109822 is related to the same product and fixed in the same release, but it is distinct from this command-injection vulnerability.
Technical Notes
The public advisories do not provide a reproducible exploit request or a complete code-level trace. Do not create production detections based on an assumed parameter name or endpoint. Instead, monitor Web GUI requests and administrative changes, and correlate them with unexpected process, configuration, or network activity on the device.
Who’s Exposed
The affected product is the Yamaha NWR100 wireless LAN router running firmware Rev.26.00.07 or earlier. The JPCERT/CC advisory states that other Yamaha router products are not affected by this vulnerability. Asset inventories should identify both the exact model and the installed firmware revision rather than grouping all Yamaha networking equipment together.
Exposure is determined by reachability as well as firmware. A device whose Web GUI is reachable from an untrusted network, guest segment, partner network, or the Internet presents greater risk than an isolated management interface. The supplied material indicates that the NWR100’s default configuration reportedly does not permit Web GUI access from the Internet, but administrators must verify their own configuration, forwarding rules, management ACLs, and source-IP filters.
| Product | Affected versions | Fixed version | Exposure condition |
|---|---|---|---|
| Yamaha NWR100 | Rev.26.00.07 and earlier | Rev.26.00.08 | An attacker can reach the Web GUI |
| Other Yamaha router products | Not reported as affected | Not applicable to this CVE | Confirm product scope with Yamaha |
Prioritize NWR100 devices in branch offices, small businesses, remote sites, and unmanaged network closets. Internet-facing administration, broad internal management access, and shared or flat networks increase the number of systems that may be able to attempt exploitation.
Severity Breakdown
The CVSS v3.1 score is 9.8 Critical, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. AV:N means the attack can be delivered over a network. AC:L indicates that no unusual conditions are required beyond reaching the vulnerable functionality. PR:N means the assessment requires no privileges, and UI:N means no separate user action is required.
The impact metrics are all high: confidentiality, integrity, and availability can each be significantly affected. S:U means the assessed impact remains within the vulnerable security authority, which does not reduce the operational importance of a compromised router. JVN also reports a CVSS v4.0 score of 9.3, including high impacts to the vulnerable system’s confidentiality, integrity, and availability.
CVSS does not account for every environmental factor. A router management interface exposed to the public Internet should receive immediate attention, while a device restricted to a dedicated management VLAN may have a smaller attack surface. Neither situation removes the need to patch, because network controls can fail, configurations can drift, and attackers may first compromise an internal system with management access.
Exploitation Status
No confirmed exploitation in the wild was identified in the reviewed primary sources. CVE-2026-97854 is also not listed in the CISA Known Exploited Vulnerabilities catalog at the time of checking. Consequently, there is no CISA KEV date added, due date, required action, or ransomware-campaign flag associated with this CVE.
No relevant public proof-of-concept repository or exploit was identified in the reviewed searches. This is an absence of identified public evidence, not proof that private exploit code does not exist. The vulnerability remains attractive to attackers because it is remotely exploitable, requires no authentication under the CVSS assessment, and can result in arbitrary OS command execution.
Security teams should distinguish between “no confirmed exploitation identified” and “safe to defer.” Treat the issue as high priority, especially where the Web GUI is exposed outside a tightly controlled administrative network. Preserve relevant logs and configuration evidence before making changes if compromise is suspected.
Sources
The primary technical references are the JPCERT/CC Japan Vulnerability Notes advisory and Yamaha’s vendor security advisory. They identify the affected NWR100 firmware range, classify the issue as OS command injection, and identify Rev.26.00.08 as the fixed release.
The NVD record and CISA KEV catalog provide supporting vulnerability and exploitation-status references. The absence of a CISA KEV entry and the absence of a public proof of concept in the reviewed searches should be reassessed over time as new research or incident reporting appears.
- JPCERT/CC / Japan Vulnerability Notes, CVE-2026-97854
- Yamaha Corporation security advisory
- NVD record for CVE-2026-97854
- CISA Known Exploited Vulnerabilities Catalog
The related CVE-2026-109822 configuration-file disclosure issue is separate from CVE-2026-97854, although both issues are addressed by upgrading the NWR100 to Rev.26.00.08.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start with an asset and exposure review. Identify all NWR100 devices, record their firmware revisions, and determine which interfaces and source networks can reach the Web GUI. Review firewall, router, VPN, and management-plane logs for requests to NWR100 administration interfaces from unexpected source addresses, especially Internet, guest, or user workstation networks.
The public material does not disclose the vulnerable endpoint, parameter, or a vendor-specific detection signature. As a result, there is no defensible universal URI or payload pattern to publish for this CVE. Detection should focus on anomalous Web GUI access, unexpected administrative changes, and behavior inconsistent with normal router operation.
Technical Notes
A generic web-proxy or firewall query can identify requests to the device’s management interface from sources outside the approved administration range. Adapt field names to the logging platform:
# Generic SIEM logic
destination_ip IN (NWR100_management_addresses)
AND destination_port IN (80, 443)
AND source_ip NOT IN (approved_management_subnets)
For web-server or reverse-proxy logs, investigate unusual requests to the NWR100 management host and correlate them with configuration changes or service restarts:
# Illustrative pattern; confirm fields and paths in local logs
destination_host="nwr100.example"
AND (http_method IN ("POST", "PUT")
OR uri_path CONTAINS "/cgi"
OR uri_path CONTAINS "/admin")
AND source_ip NOT IN ("trusted-admin-subnets")
These are detection starting points, not confirmed exploit signatures. Review requests with unusual encoding, shell metacharacters, unexpected command-like strings, repeated errors, or abnormal request sizes, but do not assume that the presence or absence of such strings proves exploitation. If the NWR100 does not retain sufficient Web GUI or system logs, collect upstream firewall and proxy records and compare the device’s configuration, firmware, DNS, routing, and outbound connection state with a known-good baseline.
Remediation Steps
Upgrade every affected NWR100 running Rev.26.00.07 or earlier to firmware Rev.26.00.08. Obtain the firmware through Yamaha’s official support or vendor advisory process, validate the downloaded file according to Yamaha’s instructions, and schedule the update using the organization’s change-control procedure. Confirm the running revision after reboot and retain evidence of the completed update.
If an immediate upgrade is not possible, restrict access to the Web GUI with access-control settings and source-IP address filtering. Remove public exposure, block access from untrusted and user networks, and permit administration only from a dedicated management subnet or approved jump host. These measures reduce exposure but do not correct the vulnerable code and should be treated as temporary risk reduction.
Security teams should also review adjacent device and identity controls. If a router may have been compromised, rotate administrative credentials through a trusted workstation and review connected systems for suspicious changes. For background on limiting excessive administrative access, see our explanation of the principle of separation of duties.
Technical Notes
The remediation command depends on Yamaha’s management method and local deployment process. Do not apply a generic Linux package command to this appliance. Use the Yamaha-provided firmware update workflow to install Rev.26.00.08, then verify the installed revision in the Web GUI or device CLI according to the product documentation.
A temporary network-control example, expressed as a policy requirement rather than a vendor-specific command, is:
ALLOW source=admin_management_subnet destination=NWR100_WebGUI service=HTTPS
DENY source=any destination=NWR100_WebGUI service=HTTP_HTTPS
Implement the equivalent rule on the organization’s firewall or access-control system, and ensure that port forwarding or reverse-proxy publication of the Web GUI is removed. After containment, review configuration exports, administrative accounts, DNS and routing settings, firmware information, and outbound connections for unexpected changes. If compromise is suspected, isolate the device, preserve available evidence, and follow the organization’s incident-response process before restoring it from a trusted configuration.