Medium severity · published Oct 29, 2026
CVE-2026-109822
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information
New
6.5
CVSS
–
EPSS
No
On KEV
Description
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NW
NWR100 · Yamaha Corporation
through Rev.26.00.07 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109822
www.rtpro.yamaha.co.jp
https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html
jvn.jp
https://jvn.jp/en/vu/JVNVU91027179/
More from NWR100
9.8
CVE-2026-97854
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability