CVE-2026-7415 Details

A vulnerability exists in the MQTT broker of Yarbo robot firmware version 2.3.9, allowing anonymous connections without any topic-level read or write access controls. This misconfiguration enables any host on the same network to subscribe to sensitive telemetry topics or publish control messages directly to the robot, all without authentication or authorization. The issue is exacerbated by a separate vulnerability that creates a persistent SSH backdoor, allowing remote root access to the robots.

Yarbo should disable anonymous access to the MQTT broker, require client authentication, and implement topic-level access controls to restrict publish and subscribe permissions to authorized clients only.