CVE-2026-97854

Summary

The Yamaha NWR100 wireless LAN router contains an OS command injection vulnerability (CWE-78) allowing unauthenticated remote attackers to execute arbitrary operating system commands via a specially crafted HTTP request.

Exploitability

Exploitation is highly likely due to the CVSS vector indicating no authentication, no user interaction, and low attack complexity.

Blast radius

Successful exploitation could lead to full system compromise including data exfiltration, service disruption, or use of the router as a pivot point for lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later, as this is the fixed version specified in the vendor advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.