Nwr100
Monthly
Yamaha wireless LAN router NWR100 stores sensitive information insecurely in configuration files produced by its CONFIG file export function, and those exported files can be read by an unauthenticated attacker, exposing their contents. Affected units are NWR100 devices running firmware Rev.26.00.07 and earlier (tracked as CPE cpe:2.3:a:yamaha_corporation:nwr100, advisory JVNVU91027179), and the impact is confidentiality-only - no integrity or availability effect is described. The CVSS 4.0 base score is 7.1 and the vendor-side assessment corresponds to CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N); no public exploit code and no confirmed active exploitation are identified in the available data, and the JVN/Yamaha advisories should be treated as the primary source for update guidance.
OS command injection in Yamaha NWR100 wireless LAN routers (Rev.26.00.07 and earlier) lets remote unauthenticated attackers execute arbitrary OS commands by sending a specially crafted request to a reachable service. The issue is CWE-78 and carries a CVSS v4.0 score of 9.3 from the source, with the independent assessment confirming remote unauthenticated exploitation and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified in the available data; the vuln.today decision label is act_now, and the practical limiting factor is whether the affected request-handling interface is reachable from the attacker's position.
Yamaha wireless LAN router NWR100 stores sensitive information insecurely in configuration files produced by its CONFIG file export function, and those exported files can be read by an unauthenticated attacker, exposing their contents. Affected units are NWR100 devices running firmware Rev.26.00.07 and earlier (tracked as CPE cpe:2.3:a:yamaha_corporation:nwr100, advisory JVNVU91027179), and the impact is confidentiality-only - no integrity or availability effect is described. The CVSS 4.0 base score is 7.1 and the vendor-side assessment corresponds to CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N); no public exploit code and no confirmed active exploitation are identified in the available data, and the JVN/Yamaha advisories should be treated as the primary source for update guidance.
OS command injection in Yamaha NWR100 wireless LAN routers (Rev.26.00.07 and earlier) lets remote unauthenticated attackers execute arbitrary OS commands by sending a specially crafted request to a reachable service. The issue is CWE-78 and carries a CVSS v4.0 score of 9.3 from the source, with the independent assessment confirming remote unauthenticated exploitation and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified in the available data; the vuln.today decision label is act_now, and the practical limiting factor is whether the affected request-handling interface is reachable from the attacker's position.