Yamaha NWR100 CVE-2026-97854

No special conditions in the CVSS sense - the vector is AV:N/AC:L/PR:N/UI:N, indicating remote unauthenticated exploitation with no user interaction against the NWR100. The attacker must be able to reach the affected request-handling interface over the network, so exposure depends on whether the router's vulnerable service is reachable from the attacker's position (e.g., WAN-facing management versus LAN-only). The available sources describe the flaw only as 'sending a specially crafted request'; the exact interface, protocol, or parameter that carries the injected command is not described in the available sources. The primary limiting factor is network reachability of the affected device/service; affected scope is NWR100 at Rev.26.00.07 and earlier.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction and high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), scoring 9.3. The vuln.today decision label is act_now and the report originates from JPCERT/CC via JVN, which raises confidence in the finding's legitimacy. Signals are consistent rather than conflicting: an OS command injection (CWE-78) on a network-facing router with PR:N aligns with the act_now priority. However, some decision signals are absent from the input: no EPSS exploitation-probability score is provided, the vulnerability is NOT listed in CISA KEV, and no public exploit or PoC reference is present - so there is currently no evidence of active exploitation or weaponization. The urgency here rests on the act_now label plus the intrinsic severity of unauthenticated remote command execution on an edge device, not on observed exploitation. Treat as urgent to patch given the device class (an internet-facing router is a high-value target), while noting the absence of EPSS/KEV/PoC data means real-world exploitation frequency cannot be quantified from the provided sources.

A remote, unauthenticated attacker sends a specially crafted request to the NWR100's management or service interface, injecting OS commands that the device executes with its own privileges. Because the router is a network edge device, successful exploitation can give the attacker a foothold to pivot into the internal network or disrupt connectivity. No public exploit code or PoC reference is present in the provided sources.