CVE-2026-7414: Hardcoded credentials in Yarbo robot firmware

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-798

Description

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

Affected products

Yarbo Lawn Mower Firmware: 2.3.9
Yarbo Lawn Mower Pro Firmware: 2.3.9

References

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk

Get alerted when CVE-2026-7414 or the next vulnerability affects your stack