critical
advisory
Yamaha NWR100: OS command injection (CVE-2026-97854)
The Yamaha NWR100 wireless LAN router is susceptible to an OS command injection vulnerability, allowing arbitrary OS commands to be executed via a specially crafted request.
CVE search metadata
CVE search record: CVE-2026-97854. Severity: critical. CVSS: 9.8. KEV: no. Product: NWR100. Brief: Yamaha NWR100: OS command injection (CVE-2026-97854). Brief link: https://feed.craftedsignal.io/briefs/2026-10-yamaha-nwr100-rce/
Triage facts
Revision 1- Applicability
- NWR100
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 13:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Yamaha wireless LAN router NWR100 contains an OS command injection vulnerability (CVE-2026-97854). Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.