Vulnerability in Yarbo Firmware
CVE-2026-7414
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (51.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.007 · change: +0.001
Affected products
- Yarbo Firmware — versions 0
- Yarbo Lawn Mower
- Yarbo Lawn Mower Firmware — versions 2.3.9
- Yarbo Lawn Mower Pro
- Yarbo Lawn Mower Pro Firmware — versions 2.3.9
Weakness classification (CWE)
References
- github.com/Bin4ry/yarbo-nat-in-my-back-yard (Exploit, Third Party Advisory, third-party-advisory)
- takeonme.org/gcves/GCVE-1337-2026-000000000000000000000000000000000000000000000… (Third Party Advisory, third-party-advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-7414?
- CVE-2026-7414 is a critical-severity vulnerability in Yarbo Firmware, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2026-05-07.
- How severe is CVE-2026-7414?
- Critical severity. CVSS v3 base score is 9.8 out of 10.