External risk intelligence

Yamaha NWR100 OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-97854

The affected product is a wireless LAN router. Network routers, especially those with management interfaces or gateway functions, are frequently deployed as internet-facing devices at the network edge to facilitate connectivity, making them commonly reachable from the public internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Yamaha wireless LAN routers that could allow an attacker to execute arbitrary commands remotely by sending a specially crafted request. This could have broad implications for network security and data integrity.

Unauthenticated remote command execution in routers.
Routers are critical network infrastructure.
Confirm if any Yamaha routers are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the Yamaha wireless LAN router. This allows them to execute arbitrary operating system commands on the device, potentially leading to a complete compromise of the router's functionality and the network it manages.

No authentication or user interaction needed.
Sending a crafted request to the router.
Arbitrary OS command execution and network compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Yamaha wireless LAN routers could allow an attacker to execute arbitrary commands on the device by sending a specially crafted request. The conditions under which this could occur are when the device is accessible via a network. There is no explicit mention of exposed data types, PII, or specific business impact in the provided context.

Device command execution.
Specially crafted network requests.
Unspecified system impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Yamaha NWR100 wireless LAN routers, making them susceptible to OS command injection. The first practical step is to identify all deployed NWR100 devices, determine their network exposure, and confirm their business criticality to prioritize remediation efforts. Coordination with the vendor may be necessary for specific guidance or fixes.

Device owners must confirm deployment and reachability.
Verify exposure and business criticality of each device.
Plan remediation based on confirmed risk and vendor guidance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Yamaha NWR100?

The Yamaha NWR100 is a wireless LAN router designed by Yamaha Corporation. These devices are used to manage network traffic and provide internet connectivity for various environments. As core networking hardware, they act as the gateway between local systems and external networks, making them essential for routing data packets reliably and maintaining connectivity across the infrastructure they support.

How does CVE-2026-97854 work?

This vulnerability is classified as OS command injection, identified as CWE-78. It means the router incorrectly processes incoming network requests, allowing an attacker to insert and execute unauthorized system commands directly on the device's operating system. Instead of simply routing data, the device interprets parts of a malicious request as instructions to be run, potentially granting the sender complete control over the router's core functions.

Do I need special access to trigger the bug?

No. The vulnerability does not require authentication or any form of user interaction. An attacker can attempt to trigger the flaw simply by sending a specially crafted request to the device over the network. It is important to note that this requires the router to process the malicious network input; it cannot be triggered by unrelated traffic that does not contain the specifically crafted command sequence.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that the NWR100 is a wireless LAN router, which is often deployed at the network edge as an internet-facing device. Because such hardware is frequently positioned to facilitate connectivity directly from the public internet, these devices are commonly reachable by external actors. If your router is accessible from the internet, it is considered highly exposed.

What should I do if I use this router?

Your first step is to inventory your network to confirm if any NWR100 units are currently deployed. Once identified, evaluate whether these devices are reachable from the internet or restricted to internal traffic. Document their role in your environment to understand the potential impact, and monitor official communication channels from Yamaha for specific remediation guidance or firmware updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.