CVE-2026-7415

Katalog CVE

CVSS 9.8 · Critical EPSS 0,71%

Kerentanan Missing Authentication for Critical Function pada yarbo lawn mower firmware, yarbo lawn mower pro firmware. Skor CVSS 3.1 9.8 (Critical) menurut takeonme.org.

Deskripsi (NVD)

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber takeonme.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Bin4ry/yarbo-nat-in-my-back-yard exploit · advisory pihak ketiga
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111... advisory pihak ketiga