CVE-2026-97854: critical OS command injection flaw in Yamaha NWR100

CVE-2026-97854 is an OS command injection vulnerability affecting the Yamaha NWR100 wireless LAN router, manufactured by Yamaha Corporation. According to the official NVD description, an attacker can send a specially crafted request to the device and achieve execution of arbitrary commands on the underlying operating system.

The vulnerability carries a CVSS score of 9.8, placing it in the critical tier, and was published on NVD on October 29, 2026. Available data shows no reports of public exploit repositories nor confirmation of active exploitation in the wild. However, there is notable social media discussion around this CVE within the last 24 hours, with some unverified posts citing firmware versions and update guidance: this information serves only as an attention signal and is not confirmed by the official source.

Organizations using Yamaha NWR100 devices should prioritize checking their installed firmware version through official vendor channels and apply security updates as soon as they become available. In the meantime, access to the router's web management interface should be restricted to trusted networks and authorized administrators only, reducing exposure to malicious requests originating from the internet or untrusted network segments.