CVE-2026-97854: Command Injection
Published Oct 29, 2026
·Updated
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
Affected Software
1 affected component
Yamaha NWR100
Event History
Oct 29, 2026
CVE Published
via MITRE·11:33 AM
Data Sourced
via MITRE·11:33 AM
DescriptionSeverity
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker who can send a specially crafted request to an affected Yamaha NWR100 can exploit it. The network attack vector and lack of required privileges or user interaction indicate that reachable devices are exposed.
2
What could a successful attacker do?
A successful exploit can execute arbitrary OS commands on the affected router. The listed impact includes high confidentiality, integrity, and availability impact.