CVE-2026-7414

Published: May 7, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: cve@takeonme.org (Secondary)

Description

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

Affected (2)

Products: Yarbo: Lawn Mower Firmware, Lawn Mower Pro Firmware

2 products

Lawn Mower Firmware

Lawn Mower Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Pro Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower Pro	All versions

Related CWEs

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (3)

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard

Source: cve@takeonme.org

ExploitThird Party Advisory

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000

Source: cve@takeonme.org

Third Party Advisory

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.