A hidden, persistent backdoor was discovered in Yarbo firmware version 2.3.9, granting remote, unauthenticated or weakly authenticated users privileged functionality. The backdoor is undocumented, cannot be disabled through user‑facing settings, and survives factory resets and ordinary firmware updates. This flaw enables attackers to gain high‑level control over the device without needing legitimate credentials.

Yarbo firmware 2.3.9, specifically the embedded robotic platform. No other affected versions are enumerated in the available data.

The CVSS score is 7.2, indicating a high severity threat. The EPSS score is < 1%, indicating a very low but nonzero exploitation likelihood, but the backdoor's persistence and lack of deactivation raise significant risk. The vulnerability is not listed in CISA's KEV catalog, reducing exposure to known exploitation campaigns. Attackers likely exploit the flaw via network connections to the robot, using undocumented interfaces or hardcoded credentials, as the backdoor accepts unauthenticated requests.