Yamaha
Monthly
Yamaha wireless LAN router NWR100 stores sensitive information insecurely in configuration files produced by its CONFIG file export function, and those exported files can be read by an unauthenticated attacker, exposing their contents. Affected units are NWR100 devices running firmware Rev.26.00.07 and earlier (tracked as CPE cpe:2.3:a:yamaha_corporation:nwr100, advisory JVNVU91027179), and the impact is confidentiality-only - no integrity or availability effect is described. The CVSS 4.0 base score is 7.1 and the vendor-side assessment corresponds to CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N); no public exploit code and no confirmed active exploitation are identified in the available data, and the JVN/Yamaha advisories should be treated as the primary source for update guidance.
OS command injection in Yamaha NWR100 wireless LAN routers (Rev.26.00.07 and earlier) lets remote unauthenticated attackers execute arbitrary OS commands by sending a specially crafted request to a reachable service. The issue is CWE-78 and carries a CVSS v4.0 score of 9.3 from the source, with the independent assessment confirming remote unauthenticated exploitation and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified in the available data; the vuln.today decision label is act_now, and the practical limiting factor is whether the affected request-handling interface is reachable from the attacker's position.
VOCALOID6 Editor fails to disable XML external entity resolution when it parses project files, so a crafted project can cause unintended outbound communication, disclosure of files readable by the editor process, or a denial-of-service crash. The issue is rated CVSS 7.1 and requires local file loading plus user interaction (AV:L/UI:R, PR:N), which limits practical exploitation to social-engineering delivery of a malicious project file. No public exploit code or active exploitation was identified in the provided intelligence, making this a genuine but not emergency-priority risk.
Active debug code exists in Yamaha wireless LAN access point devices. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA. Rated medium severity (CVSS 5.4). No vendor patch available.
Yamaha wireless LAN router NWR100 stores sensitive information insecurely in configuration files produced by its CONFIG file export function, and those exported files can be read by an unauthenticated attacker, exposing their contents. Affected units are NWR100 devices running firmware Rev.26.00.07 and earlier (tracked as CPE cpe:2.3:a:yamaha_corporation:nwr100, advisory JVNVU91027179), and the impact is confidentiality-only - no integrity or availability effect is described. The CVSS 4.0 base score is 7.1 and the vendor-side assessment corresponds to CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N); no public exploit code and no confirmed active exploitation are identified in the available data, and the JVN/Yamaha advisories should be treated as the primary source for update guidance.
OS command injection in Yamaha NWR100 wireless LAN routers (Rev.26.00.07 and earlier) lets remote unauthenticated attackers execute arbitrary OS commands by sending a specially crafted request to a reachable service. The issue is CWE-78 and carries a CVSS v4.0 score of 9.3 from the source, with the independent assessment confirming remote unauthenticated exploitation and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV active exploitation is identified in the available data; the vuln.today decision label is act_now, and the practical limiting factor is whether the affected request-handling interface is reachable from the attacker's position.
VOCALOID6 Editor fails to disable XML external entity resolution when it parses project files, so a crafted project can cause unintended outbound communication, disclosure of files readable by the editor process, or a denial-of-service crash. The issue is rated CVSS 7.1 and requires local file loading plus user interaction (AV:L/UI:R, PR:N), which limits practical exploitation to social-engineering delivery of a malicious project file. No public exploit code or active exploitation was identified in the provided intelligence, making this a genuine but not emergency-priority risk.
Active debug code exists in Yamaha wireless LAN access point devices. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810 firmware Rev.11.01.33 and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA. Rated medium severity (CVSS 5.4). No vendor patch available.