{"id":"CVE-2026-97854","published":"2026-10-29T12:17:14.443","lastModified":"2026-10-29T15:45:15.310","description":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/vu/JVNVU91027179/","tags":[]},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Yamaha NWR100 wireless LAN router contains an OS command injection vulnerability (CWE-78) allowing unauthenticated remote attackers to execute arbitrary operating system commands via a specially crafted HTTP request.","exploitability":"Exploitation is highly likely due to the CVSS vector indicating no authentication, no user interaction, and low attack complexity.","blast_radius":"Successful exploitation could lead to full system compromise including data exfiltration, service disruption, or use of the router as a pivot point for lateral movement within the network.","remediation":"Upgrade to firmware version 2.590 or later, as this is the fixed version specified in the vendor advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","router","embedded-device","no-auth"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:12:54.246Z"}}