CVE-2026-7415

Published: May 7, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: cve@takeonme.org (Secondary)

Description

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

Affected (2)

Products: Yarbo: Lawn Mower Firmware, Lawn Mower Pro Firmware

2 products

Lawn Mower Firmware

Lawn Mower Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yarbo Lawn Mower Pro Firmware	Version 2.3.9

Running on/with	Platform Versions
Yarbo Lawn Mower Pro	All versions

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard

Source: cve@takeonme.org

ExploitThird Party Advisory

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001

Source: cve@takeonme.org

Third Party Advisory

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.