What is the CVSS score of CVE-2026-7414?

CVE-2026-7414 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Yarbo firmware are affected by CVE-2026-7414?

Yarbo firmware v2.3.9 contains hardcoded administrative credentials accessible to any remote attacker without authentication, granting complete device compromise across all deployed units.

How to fix or mitigate CVE-2026-7414?

Within 24 hours: Inventory all Yarbo devices running firmware v2.3.9 and isolate them from production networks if operationally feasible; contact Yarbo vendor for patch timeline and interim guidance. Within 7 days: Implement network segmentation to restrict Yarbo device management access to secured administrative networks only; deploy network-based monitoring for unauthorized administrative logins to affected devices. Within 30 days: Apply vendor-released patch to all Yarbo devices immediately upon availability; if no patch emerges, evaluate replacement of affected devices or decommissioning.

Yarbo firmware CVE-2026-7414

EUVD-2026-28399 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-07 AHA

GHSA-vw42-99fw-3p5g

Authentication Bypass Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 17:30 vuln.today

CVE Published

May 07, 2026 - 16:10 nvd

CRITICAL 9.8

DescriptionCVE.org

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

AnalysisAI

Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device administrative access across all deployed units. The CVSS 9.8 critical score reflects the complete lack of authentication barriers (AV:N/AC:L/PR:N), with identical credentials embedded in every device that cannot be changed by end users. No active exploitation has been confirmed by CISA KEV, but a public GitHub repository reference suggests potential proof-of-concept availability. EPSS data unavailable, though the trivial exploitation path (no complexity, no privileges required) indicates high weaponization potential once credentials become widely known.

Technical ContextAI

CWE-798 (Use of Hard-coded Credentials) represents a fundamental authentication failure where static credentials are compiled directly into firmware binaries. The CPE identifier cpe:2.3:a:yarbo:firmware:*:*:*:*:*:*:*:* indicates this affects Yarbo firmware products, with v2.3.9 specifically called out. Hardcoded credentials in embedded device firmware typically persist in flash memory, accessible through reverse engineering or memory dumps. Unlike server applications where credentials can be rotated, firmware-embedded secrets require full reflashing to remediate. The network attack vector (AV:N) suggests these credentials protect web interfaces, SSH/Telnet services, or API endpoints exposed on local networks or potentially the internet if devices lack proper network segmentation.

RemediationAI

Immediately upgrade to Yarbo firmware version newer than v2.3.9 if available, consulting vendor security advisories at https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000 for patch release details. Since hardcoded credentials cannot be changed in v2.3.9, firmware upgrade is the only permanent fix. As immediate compensating controls: isolate affected devices to dedicated network segments with strict firewall rules blocking all inbound access except from authorized management systems via IP allowlisting (trade-off: limits remote management flexibility). Disable all remote management interfaces if operationally feasible and manage devices only via local console access (trade-off: increases operational overhead). Deploy network intrusion detection to alert on authentication attempts to device management ports from unexpected source IPs (trade-off: detective not preventive control). Monitor device logs for unauthorized access patterns, though attackers using valid credentials may evade detection. These mitigations reduce attack surface but do not eliminate the vulnerability - firmware replacement remains mandatory.