CVE-2026-7414

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	Exploit Third Party Advisory
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000	Third Party Advisory
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*

cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-07 17:15

Updated : 2026-06-17 11:02

NVD link : CVE-2026-7414

Mitre link : CVE-2026-7414

CVE.ORG link : CVE-2026-7414

JSON object : View

Products Affected

yarbo

lawn_mower_firmware
lawn_mower
lawn_mower_pro_firmware
lawn_mower_pro

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-7414", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7414", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T17:01:33.390607Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@takeonme.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@takeonme.org", "affectedData": [{"vendor": "Yarbo", "product": "Firmware", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T17:15:59.460", "references": [{"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000", "tags": ["Third Party Advisory"], "source": "cve@takeonme.org"}, {"url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@takeonme.org", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them."}], "lastModified": "2026-06-17T11:02:23.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40676938-F32C-4254-8BB6-51355E2A9B52"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "94EEF528-48EF-4892-B74A-B79B79AFC417"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BF14480-B5C0-4EF9-A9BA-81AD73B7588E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "165A0B1F-A9BD-4C58-A4CE-26C4CBCD4C21"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@takeonme.org"}