Yarbo firmware EUVD-2026-28400

Network connectivity to the Yarbo device's MQTT broker port (default TCP 1883) from the same local network segment. The vulnerability description explicitly states 'any host on the same network,' indicating exploitation is limited to adjacent network access (not internet-wide unless the device is exposed via port forwarding, DMZ placement, or cloud relay). No special Yarbo features need to be enabled - the MQTT broker runs by default in firmware v2.3.9 with anonymous access. No user interaction, elevated privileges, or non-default configuration required on the target device. Exploitation IS limited by network segmentation: devices on isolated VLANs, behind properly configured firewalls, or on networks with client isolation (AP isolation) enabled are protected from casual opportunistic attacks but remain vulnerable to attackers who compromise any host on the same network segment.

Real-world risk is CRITICAL for affected devices. CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N accurately reflects the severity: network-accessible, low complexity, no privileges or user interaction required. The scope is unchanged (S:U), but confidentiality, integrity, and availability impacts are all HIGH, appropriate for a device that can physically move and operate cutting blades. Attack complexity is genuinely low - connecting to an MQTT broker requires only standard client tools (mosquitto_pub/sub, MQTT.js, Paho). While the network attack vector typically implies internet exposure, the description clarifies 'same network' access is required, suggesting AV:A (adjacent network) would be more accurate, though many consumer IoT devices are inadvertently exposed via UPnP, port forwarding, or cloud relay services. No EPSS score or KEV status provided, preventing assessment of in-the-wild exploitation prevalence. GitHub reference 'yarbo-nat-in-my-back-yard' suggests proof-of-concept or research demonstrating the vulnerability. SSVC decision factors: Exploitation is Public (POC exists), Technical Impact is Total (complete device control), and the vulnerability is likely Automatable (MQTT scanning and exploitation can be scripted). Priority is HIGH for any organization deploying Yarbo devices, especially in commercial landscaping or shared network environments. The physical safety implications of unauthorized robot control elevate this beyond typical IoT vulnerabilities.

An attacker on the same Wi-Fi network as a Yarbo robotic mower (e.g., shared residential network, coffee shop, or corporate campus) runs mosquitto_sub to discover active MQTT topics and observe real-time telemetry including GPS coordinates, operational status, and scheduling data. The attacker then publishes crafted messages to control topics, issuing commands to start the mower's blades, override safety interlocks, redirect the mower to unauthorized areas, or disable the device entirely. Physical harm, property damage, and operational disruption result. Proof-of-concept code exists per GitHub reference, lowering technical barriers to exploitation.