What is the CVSS score of CVE-2026-7415?

CVE-2026-7415 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Yarbo firmware are affected by CVE-2026-7415?

Yarbo robotic lawn mower firmware v2.3.9 contains a critical authentication bypass in its embedded MQTT broker that allows any attacker on the local network to remotely control the device and steal…

How to fix or mitigate CVE-2026-7415?

Within 24 hours: Inventory all Yarbo devices running firmware v2.3.9 and isolate them to a segregated network segment with no internet access. Within 7 days: Contact Yarbo support to determine available firmware updates or workarounds; temporarily disable MQTT functionality if the device interface permits. Within 30 days: Implement network-level segmentation using firewall rules to restrict MQTT port 1883 access to authorized management systems only, and deploy network monitoring to detect unauthorized MQTT connections to affected devices.

Yarbo firmware CVE-2026-7415

EUVD-2026-28400 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-07 AHA

GHSA-5jxr-5v22-49gf

Authentication Bypass Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 17:30 vuln.today

CVE Published

May 07, 2026 - 16:11 nvd

CRITICAL 9.8

DescriptionCVE.org

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

AnalysisAI

Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully control the robotic lawn mower and exfiltrate sensitive telemetry data. The embedded MQTT broker accepts connections without credentials and enforces no topic-level access controls, enabling arbitrary publish/subscribe operations. No authentication, authorization, or message validation occurs. EPSS and KEV data not available; exploitation requires only network access to the robot's MQTT port (typically TCP 1883).

Technical ContextAI

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol commonly used in IoT devices for telemetry and command-and-control communication. The Yarbo firmware (CPE: cpe:2.3:a:yarbo:firmware:*:*:*:*:*:*:*:*) embeds an MQTT broker for robot control and status reporting. This vulnerability represents CWE-306 (Missing Authentication for Critical Function), where the broker is configured with allow_anonymous=true and lacks topic-level ACLs (Access Control Lists). In properly configured MQTT deployments, brokers require client authentication (username/password or certificates) and restrict topic access via ACL rules defining which clients can read (subscribe) or write (publish) to specific topic hierarchies. The absence of both controls means any network-reachable client can connect anonymously and interact with all topics, including those controlling physical robot operations and exposing sensitive operational telemetry.

RemediationAI

No vendor-released patch identified at time of analysis. The second reference URL (https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001) appears malformed or placeholder, providing no actionable advisory. Until Yarbo releases firmware beyond v2.3.9 with MQTT authentication enabled, implement network-level compensating controls: (1) Isolate Yarbo devices on a dedicated VLAN with no internet access and strict firewall rules blocking inbound TCP port 1883 from untrusted networks - side effect is potential loss of remote monitoring/control features if the vendor's cloud service relies on MQTT. (2) Deploy a reverse proxy or MQTT gateway (e.g., Mosquitto with authentication enabled) between the robot and any management clients, enforcing authentication and topic ACLs externally - requires custom integration and may break vendor mobile app functionality. (3) Disable the embedded MQTT broker entirely if feasible through undocumented firmware configuration or physical access to device shell - may render device unmanageable or void warranty. Contact Yarbo support to request an urgent security update enabling MQTT authentication (username/password minimum, certificate-based authentication preferred) and topic-level ACLs following principle of least privilege.