CVE-2026-97854

Quick assessment

Affected

Yamaha Corporation NWR100

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

雅马哈公司提供的 Yamaha NWR100 无线路由器存在操作系统命令注入漏洞。攻击者可通过向受影响产品发送特制请求，执行任意操作系统命令。

CVSS 9.8 · Critical Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Yamaha Corporation	NWR100	0 ~ Rev.26.00.07	-

II. Public POCs for CVE-2026-97854

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-97854

请登录查看更多情报信息。

Other References for CVE-2026-97854 (2)

https://www.cve.org/CVERecord?id=CVE-2026-97854

Same Patch Batch · Yamaha Corporation · 2026-10-29 · 4 CVEs total

CVE-2026-103665	8.4 HIGH	Yamaha LAN Monitor 安装程序 DLL 加载漏洞
CVE-2026-97860	8.4 HIGH	Yamaha YMS-VPN8 未加引号服务路径提权漏洞
CVE-2026-109822	6.5 MEDIUM	雅马哈 NWR100 路由器敏感信息存储漏洞

IV. Related Vulnerabilities

Same product: NWR100

CVE-2026-109822
雅马哈 NWR100 路由器敏感信息存储漏洞

Same vendor: Yamaha Corporation

Same weakness: CWE-78