Read the docs
TI-2026-82371 Aliases CVE-2026-109822GHSA-rpwj-6867-pmv9

Insecure storage of sensitive information in Yamaha NWR100 router

Priority LOW 31CWE-922Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-922.

Summary

Yamaha NWR100 wireless LAN routers provided by Yamaha Corporation, through Rev.26.00.07, store configuration files generated by the CONFIG file export function insecurely (CWE-922). An unauthenticated attacker can read these configuration files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Yamaha CorporationNWR100up to Rev.26.00.07—No fix listedCNA
  • NWR100 VendorYamaha Corporation Affected up to Rev.26.00.07 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Yamaha NWR100.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-109822
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: MEDIUM → LOW
  4. 2026-10-29 Alias added: GHSA-rpwj-6867-pmv9

References

Other 2

  • TI-2005-00319 Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with… CVSS 2.0MEDIUM 5.0
  • TI-2026-82367 OS command injection in Yamaha NWR100 wireless LAN router CVSS 4.0CRITICAL 9.3
  • TI-2008-02085 Unspecified vulnerability in Yamaha routers allows remote attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2026-82369 Insecure DLL loading in Yamaha LAN Monitor installer for Windows CVSS 4.0HIGH 8.4
  • TI-2026-82368 Unquoted service paths in Yamaha YMS-VPN8 and YMS-VPN8-CP CVSS 4.0HIGH 8.4
  • TI-2011-01163 Yamaha RTX, RT, SRT, RTV, RTW, and RTA series routers with firmware 6.x through 10.x, and… CVSS 2.0HIGH 7.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences