# CVE-2026-97854: Yamaha NWR100 OS command injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-97854-yamaha-wireless-lan-router-nwr100-provided-by-yamaha-corporation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-97854 · Severity: critical · CVSS 9.8 · Published 2026-10-29

The Yamaha NWR100 wireless LAN router is vulnerable to OS command injection attacks where unauthenticated attackers can execute arbitrary commands by sending specially crafted requests to the device. An attacker exploiting this vulnerability could gain complete control of the router, modify its configuration, disrupt service, or use it as a foothold to attack connected networks.

Vendors: [Yamaha](https://junglewise.ai/threats/vendors/yamaha).

## Quick answers

**Is CVE-2026-97854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97854 being exploited in the wild.

**How severe is CVE-2026-97854?** Critical severity, with a CVSS score of 9.8, published 29 October 2026.

**Which products and versions are affected?** Yamaha NWR100 Rev.26.00.07 and earlier.

**Is there a fix for CVE-2026-97854?** Yes: fixed in Rev.26.00.08. Until then: Restrict access to the Web GUI by configuring IP filters and access controls to limit which devices and source addresses can reach the management interface. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97854 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-97854?** Check whether you run Yamaha NWR100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Rev.26.00.08

Restrict access to the Web GUI by configuring IP filters and access controls to limit which devices and source addresses can reach the management interface.

## Technical details

The NWR100 contains an OS command injection vulnerability (CWE-78) that allows unauthenticated attackers to execute arbitrary OS commands via specially crafted network requests to the Web GUI. The attack requires network access to the device but no authentication or user interaction. A fix is available in firmware revision 26.00.08.

## Affected products

- Yamaha NWR100 Rev.26.00.07 and earlier

## Timeline

- 2026-10-28: disclosed
- 2026-10-29: advisory

## References

- [https://jvn.jp/en/vu/JVNVU91027179/](https://jvn.jp/en/vu/JVNVU91027179/)
- [https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html](https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html)

## Related threats

- [Yamaha NWR100 insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-109822-yamaha-wireless-lan-router-nwr100-provided-by-yamaha-corporation)