Vendors / Yarbo Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 1
Exploited now Yarbo records in CISA KEV No Yarbo vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00544 · Published 2026-05-07 · No fix listed CWE-306
Priority HIGH 82
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00531 · Published 2026-05-07 · No fix listed CWE-798
Priority HIGH 76
A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-05-07 · No fix listed CWE-912
Priority MEDIUM 48
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00353 · Published 2026-06-12 · Fixed in 3.17.4 CWE-798
Priority LOW 39
The Yarbo cloud does not enforce per-device or per-user authorization.
CVSS 4.0 HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00259 · Published 2026-06-12 · Fixed in 3.17.4 CWE-862
Open these records in search → All records by CVSS severity
4 1 0 0 0
THREATIST.IORead the docs