Vulnerabilities

TI-2026-09080 CVE-2026-10557 · GHSA-65ch-m8fq-jhr5

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

MEDIUM 48

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00353 Published 2026-06-12 Fixed in 3.17.4 CWE-798

TI-2026-06473 CVE-2026-7368 · GHSA-285q-8jwv-fw98

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization

LOW 39

The Yarbo cloud does not enforce per-device or per-user authorization.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00259 Published 2026-06-12 Fixed in 3.17.4 CWE-862

TI-2026-06518 CVE-2026-7415 · GHSA-5jxr-5v22-49gf

Open MQTT orchestration without read/write ACLs in Yarbo robot firmware

HIGH 82

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00544 Published 2026-05-07 No fix listed CWE-306

TI-2026-06517 CVE-2026-7414 · GHSA-vw42-99fw-3p5g

Hardcoded credentials in Yarbo robot firmware

HIGH 82

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00531 Published 2026-05-07 No fix listed CWE-798

TI-2026-06516 CVE-2026-7413 · GHSA-pq5m-hxx2-xhw5

Persistent undocumented backdoor access in Yarbo robot

HIGH 76

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00577 Published 2026-05-07 No fix listed CWE-912