CVE-2026-7413 Details
Description
A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.
A hidden backdoor has been discovered in Yarbo robot firmware version 2.3.9. This backdoor provides remote, unauthorized access to privileged functions by establishing a persistent SSH tunnel to a Yarbo-controlled server. The backdoor is not documented, cannot be disabled through user settings, and survives factory resets and regular firmware updates. The backdoor allows anyone with knowledge of a robot's serial number to access the device's root account via SSH, exploiting a hardcoded password that is reset to its default value with each firmware update.
Yarbo must remove the undocumented backdoor service, implement a proper authentication mechanism, and ensure that firmware updates and factory resets effectively eliminate any residual backdoor components.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://takeonme.org/cves/cve-2026-7413/ | CISA-ADP | Third Party Advisory |
| https://github.com/Bin4ry/yarbo-nat-in-my-back-yard | [email protected] | ExploitThird Party Advisory |
| https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111111111111111110000000000000000000000000000000000000000000000000000000111 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-912 | Hidden Functionality | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yarbo lawn mower firmware | 2.3.9 |
CPE
Remediation
| |
| yarbo lawn mower | All versions |
CPE
Remediation
| |
| yarbo lawn mower pro firmware | 2.3.9 |
CPE
Remediation
| |
| yarbo lawn mower pro | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |