CVE-2026-109822: Medium severity Yamaha NWR100 vulnerability
Published Oct 29, 2026
·Updated
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.
Affected Software
1 affected component
Yamaha NWR100
Event History
Oct 29, 2026
CVE Published
via MITRE·11:34 AM
Data Sourced
via MITRE·11:34 AM
DescriptionSeverity
Frequently Asked Questions
1
What must an attacker obtain to access the exposed information?
The attacker needs access to a configuration file generated by the router's CONFIG file export function. The issue allows an unauthenticated attacker to read that exported file.
2
What information is at risk?
The affected configuration export files contain sensitive information, although the specific data elements are not identified in the available information.
3
Are credentials or prior authentication required to exploit this issue?
No. The issue is described as allowing an unauthenticated attacker to read the generated configuration files.