Yarbo robot firmware v2.3.9 embeds an MQTT broker that accepts anonymous connections and lacks topic‑level read or write ACLs. An attacker on the same network can subscribe to sensitive telemetry topics, obtaining confidential data, and can publish control messages to manipulate the robot. This flaw enables full control over the device without authentication or authorization, raising confidentiality, integrity, and availability risks. The weakness is characterized as CWE-306, an authentication bypass vulnerability.

The affected product is Yarbo firmware version 2.3.9. No other versions or platform specifics are listed. Devices running this firmware that are reachable from a local network are vulnerable.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, so current exploit probability is unknown, but the vulnerability is in plain sight for any host on the same network, making it readily exploitable. The CVE is not listed in the CISA KEV catalog, yet the lack of authentication and ACLs makes local network compromise trivial. Attackers need only network connectivity to the MQTT broker, which is typically local to the robot.