ByteOS Network

NVD Vulnerability Details :

CVE-2026-7415

Received

Source-cve@takeonme.org

Published At-07 May, 2026 | 17:15

Updated At-07 May, 2026 | 18:16

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE ID	Type	Source
CWE-306	Secondary	cve@takeonme.org

CWE ID: CWE-306

Type: Secondary

Source: cve@takeonme.org

References

Hyperlink	Source	Resource
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	cve@takeonme.org	N/A
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001	cve@takeonme.org	N/A
https://github.com/Bin4ry/yarbo-nat-in-my-back-yard	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A