Executive brief
Yarbo, a manufacturer of multi-purpose yard robots, has a security flaw in its cloud infrastructure that fails to properly separate user accounts and devices. An attacker with any valid set of credentials can view real-time location and status data for every Yarbo robot globally and send unauthorized commands to them. This could lead to the hijacking of robot operations, unauthorized surveillance, or a complete loss of privacy for all customers.
Technical details
The vulnerability is a missing authorization check (CWE-862) within the Yarbo Cloud MQTT infrastructure. While the system requires authentication, it does not implement granular access control to ensure users can only interact with their own devices. An attacker with valid credentials—including those obtained via hard-coded strings in older app versions or legitimate user accounts—can subscribe to wildcard MQTT topics to receive telemetry for all robots. By obtaining a robot's serial number from this telemetry stream, the attacker can then publish messages to that specific robot's command topic. This allows for fleet-wide unauthorized monitoring and control. The issue is addressed via server-side updates to the MQTT broker and by updating the mobile application to version 3.17.4 or later.
Affected products
- Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update
- Yarbo Yarbo Android/iOS Mobile Application < 3.17.4
Timeline
- 2026-06-11: advisory: CISA published advisory ICSA-26-162-01
- 2026-06-12: disclosed: NVD published CVE-2026-7368
- 2026-05: patched: Server-side broker authorization enforced in May 2026 update