Yarbo firmware v2.3.9 embeds a set of hard‑coded administrative credentials that are identical on every device and cannot be altered by users. This flaw allows an attacker who knows the default login to reach the device’s management interface and perform any privileged operation, from modifying configuration and routing to executing arbitrary system commands. The result is a complete compromise of the device’s confidentiality, integrity, and availability, and it can affect the network segments in which the robot operates.

All Yarbo devices running firmware version 2.3.9 are affected. No other firmware releases or product lines have been identified as impacted.

The vulnerability’s CVSS score of 9.8 marks it as critical. The EPSS score is not available, but the ease of exploitation is high because the credentials are trivial and universal. Although the vulnerability is not listed in the CISA KEV catalog, it permits attackers with physical or remote network proximity to gain full control of the device, potentially disrupting connected systems and services.