« Volver al listado

CVE-2026-7415

Estado: AnalizadaCrítica (9.8)—

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Firmware MQTT sin autenticación en red: acceso anónimo a broker remoto (T1190, AV:N). Impactos: adquirir credenciales/cuentas válidas (T1078, sin credenciales requeridas), ejecutar comandos de control (T1059), manipular datos/estado del robot (T1565).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser Training

Tecnologías afectadas (2)

Yarbo — Lawn Mower FirmwareYarbo — Lawn Mower PRO Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-7415",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7415",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-07T17:04:20.271427Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@takeonme.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@takeonme.org",
      "affectedData": [
        {
          "vendor": "Yarbo",
          "product": "Firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "2.3.9"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-07T17:15:59.570",
  "references": [
    {
      "url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@takeonme.org"
    },
    {
      "url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@takeonme.org"
    },
    {
      "url": "https://github.com/Bin4ry/yarbo-nat-in-my-back-yard",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@takeonme.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind."
    }
  ],
  "lastModified": "2026-06-17T11:02:23.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:yarbo:lawn_mower_firmware:2.3.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40676938-F32C-4254-8BB6-51355E2A9B52"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:yarbo:lawn_mower:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "94EEF528-48EF-4892-B74A-B79B79AFC417"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:yarbo:lawn_mower_pro_firmware:2.3.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BF14480-B5C0-4EF9-A9BA-81AD73B7588E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:yarbo:lawn_mower_pro:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "165A0B1F-A9BD-4C58-A4CE-26C4CBCD4C21"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@takeonme.org"
}