CVE-2026-7413

HIGH

Persistent undocumented backdoor access in Yarbo robot

Title source: cna

Description

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.

References (3)

Core 3

Core References

Third Party Advisory third-party-advisory

https://github.com/Bin4ry/yarbo-nat-in-my-back-yard

Third Party Advisory third-party-advisory

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111111111111111110000000000000000000000000000000000000000000000000000000111

Various Sources

https://takeonme.org/cves/cve-2026-7413/

Scores

CVSS v3 7.2

EPSS 0.0058

EPSS Percentile 42.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-912

Status published

Products (3)

Yarbo/Firmware < 2.3.9

yarbo/lawn_mower_firmware 2.3.9

yarbo/lawn_mower_pro_firmware 2.3.9

Published May 07, 2026

Tracked Since May 07, 2026