The vulnerability arises from hard‑coded MQTT broker credentials embedded in the Yarbo Android and iOS apps. Because the same credentials are used for every device, an attacker who can extract them from the app binary gains unrestricted read access to all robot telemetry topics and write access to any robot command topic using only the robot serial number. This enables complete observation of the global robot fleet and the ability to issue arbitrary commands to individual robots.

The affected entities are the Yarbo Android and iOS mobile applications and the Yarbo Cloud MQTT infrastructure. All current versions of the mobile app, prior to update 3.17.4, contain the hard‑coded credentials. The corresponding cloud broker services receive connections authenticated with these credentials.

The CVSS score of 9.3 indicates critical severity, and the absence of the vulnerability in the CISA KEV catalog means it has not yet been publicly exploited, though the EPSS score is not provided. Attackers can exploit this flaw remotely by simply extracting the credentials from a decompiled APK or IPA or via other reverse‑engineering techniques and then connecting to the MQTT brokers. Once authenticated, they can listen to every telemetry feed or command any robot, which poses a high risk to confidentiality, integrity, and availability of the fleet.