Yarbo Mobile Application CVE-2026-10557

Exploitation requires only network reachability to the Yarbo cloud MQTT broker and possession of the hard-coded credentials, which any attacker can recover by decompiling the publicly distributed Yarbo Android or iOS application binary - no user authentication, user interaction, or non-default configuration is needed. Targeting a specific robot additionally requires knowledge of that robot's serial number, which is used as the topic key for command publishing; fleet-wide telemetry subscription, however, requires no serial number because the credentials permit wildcard subscription. Limiting factors are minimal: the attack is bounded only by the broker remaining online with the current credentials valid and by serial-number knowledge for per-device command injection.

All signals point to a genuinely high-priority, fleet-wide exposure rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately reflects remote, low-complexity, unauthenticated access yielding high confidentiality, integrity, and availability impact on the robot fleet, and the SSVC-style technical impact is total (full command and telemetry control). EPSS is not provided and the issue is not on the CISA KEV list, so there is no confirmed active exploitation, but POC-quality extraction is essentially trivial - any researcher with apktool/jadx can recover the credentials - so absence of public exploit code should not be read as low risk. The condition that an attacker must know a target robot's serial number lightly limits per-device targeting but does not limit mass subscription to all telemetry, and serial numbers are often weakly random or observable. Subsequent-system impact is rated N in the vector, which is reasonable since compromise is confined to Yarbo's fleet rather than crossing into customer networks, but physical safety risk from sending commands to outdoor robotic mowers is a real-world consideration the score does not capture.

An attacker downloads the Yarbo Android APK from a public mirror, decompiles it with jadx in minutes, and extracts the hard-coded MQTT username and password. Using a standard MQTT client such as mosquitto_sub, they connect to the Yarbo cloud broker and subscribe to a wildcard topic, harvesting real-time telemetry (location, status, owner identifiers) for the entire global fleet, then publish crafted command messages to a specific robot's command topic using its serial number to start, stop, or steer the device. No public exploit identified at time of analysis, but the extraction workflow is well within reach of an entry-level reverse engineer.