CVE-2026-7414

Katalog CVE

CVSS 9.8 · Critical EPSS 0,67%

Kerentanan Use of Hard-coded Credentials pada yarbo lawn mower firmware, yarbo lawn mower pro firmware. Skor CVSS 3.1 9.8 (Critical) menurut takeonme.org.

Deskripsi (NVD)

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber takeonme.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Bin4ry/yarbo-nat-in-my-back-yard exploit · advisory pihak ketiga
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111... advisory pihak ketiga
• https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk exploit · advisory pihak ketiga