Yamaha NWR100 EUVD-2026-112754

Exploitation requires that a configuration file has been generated via the NWR100's CONFIG file export function; such exported files can then be read by an unauthenticated attacker, disclosing their sensitive contents. The affected scope is Yamaha wireless LAN router NWR100 at firmware Rev.26.00.07 and earlier (per EUVD). Limiting factors: the flaw only exposes data that the CONFIG export feature has produced (it is not an arbitrary live-config read of any device), impact is confidentiality-only (no integrity or availability effect per VI:N/VA:N), and the CVSS 4.0 vector sets UI:P, indicating a passive user-interaction dependency - however, the specific interaction or deployment step that triggers exposure is not described in the available sources and should be confirmed with the Yamaha advisory.

This is a moderate-severity information-disclosure flaw (CWE-922, insecure storage of sensitive information) with a vendor/CVSS 4.0 base score of 7.1. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-reachable issue requiring no privileges but with a passive user-interaction dependency (UI:P), and impact limited strictly to confidentiality (VC:H; VI:N/VA:N). The signals are internally consistent: a high-confidentiality, no-integrity/no-availability disclosure of exported configuration files. No EPSS score, no CISA KEV listing, and no POC/exploit reference are present in the input, so exploitation likelihood cannot be quantified from probability data; status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week' (priority but not act_now/emergency), which is consistent with a credible JPCERT-reported disclosure flaw lacking confirmed active exploitation. Net assessment: a real, worth-patching confidentiality issue - exported config files can leak secrets (credentials, keys, network topology) to an unauthenticated party - but not an emergency: the UI:P requirement and the limitation to data already produced by the CONFIG export function constrain mass, drive-by exploitation. The main conflict/uncertainty is the UI:P metric: the provided description does not explain what user interaction triggers exposure, so the precise trigger is not described in the available sources and should be verified with Yamaha.

An unauthenticated attacker obtains a configuration file produced by the NWR100's CONFIG export function and reads its contents, exposing sensitive settings such as credentials, pre-shared keys, or network configuration. Because the CVSS 4.0 vector is network (AV:N), low-complexity (AC:L), and needs no privileges (PR:N) but carries a passive user-interaction dependency (UI:P), realistic exploitation hinges on an exported CONFIG file becoming reachable. No public exploit or POC is identified in the available data.