CVE-2026-7413

Published: May 7, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.

Affected (2)

Products: Yarbo: Lawn Mower Firmware, Lawn Mower Pro Firmware

2 products

Lawn Mower Firmware

Lawn Mower Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Pro Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower Pro	All versions

Related CWEs

Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

References (3)

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard

Source: cve@takeonme.org

ExploitThird Party Advisory

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111111111111111110000000000000000000000000000000000000000000000000000000111

Source: cve@takeonme.org

Third Party Advisory

https://takeonme.org/cves/cve-2026-7413/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

Timeline

No history available yet.