CVE-2026-7415

Open MQTT orchestration without read/write ACLs in Yarbo robot firmware

Published May 7, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

Analysis

Technical impact

Yarbo robot firmware v2.3.9 embeds an MQTT broker that accepts anonymous connections and lacks topic‑level read or write ACLs. An attacker on the same network can subscribe to sensitive telemetry topics, obtaining confidential data, and can publish control messages to manipulate the robot. This flaw enables full control over the device without authentication or authorization, raising confidentiality, integrity, and availability risks. The weakness is characterized as CWE-306, an authentication bypass vulnerability.

Affected Systems

The affected product is Yarbo firmware version 2.3.9. No other versions or platform specifics are listed. Devices running this firmware that are reachable from a local network are vulnerable.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, so current exploit probability is unknown, but the vulnerability is in plain sight for any host on the same network, making it readily exploitable. The CVE is not listed in the CISA KEV catalog, yet the lack of authentication and ACLs makes local network compromise trivial. Attackers need only network connectivity to the MQTT broker, which is typically local to the robot.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Yarbo

Firmware

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.3.9

Configuration 1 [-]

AND

cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Yarbo

Firmware

Version	Status	Scheme	Platform
`[0,2.3.9]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Yarbo firmware to the latest version that includes MQTT authentication and ACLs
Apply network segmentation or firewall rules to limit access to the robot’s MQTT broker to trusted hosts only
Configure the MQTT broker to require client authentication and define topic‑level read/write ACLs to prevent unauthenticated access
Disable anonymous connections in the MQTT broker configuration

Generated by OpenCVE AI on May 7, 2026 at 18:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.544% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001

History

May 14, 2026 6:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Yarbo lawn Mower Yarbo lawn Mower Firmware Yarbo lawn Mower Pro Yarbo lawn Mower Pro Firmware
CPEs		cpe:2.3:h:yarbo:lawn_mower:-:::::::* cpe:2.3:h:yarbo:lawn_mower_pro:-:::::::* cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:::::::* cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:::::::*
Vendors & Products		Yarbo lawn Mower Yarbo lawn Mower Firmware Yarbo lawn Mower Pro Yarbo lawn Mower Pro Firmware

May 7, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Yarbo Yarbo firmware
Vendors & Products		Yarbo Yarbo firmware

May 7, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 7, 2026 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.
Title		Open MQTT orchestration without read/write ACLs in Yarbo robot firmware
Weaknesses		CWE-306
References		https://github.com/Bin4ry/yarbo-nat-in-my-back-yard https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`