# CVE-2026-7414: Yarbo Lawn Mower hardcoded credentials in firmware

Source: https://junglewise.ai/threats/cve-2026-7414-yarbo-lawn-mower-hardcoded-credentials-in-firmware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-7414 · Severity: critical · CVSS 9.8 · Published 2026-05-07

Yarbo smart lawn mowers contain permanent, factory-set administrative passwords that are identical across all devices. An attacker who knows these credentials can remotely access and control the mower's management interface. This could lead to unauthorized operation of the device, changes to its configuration, or complete loss of control for the owner.

Technologies: [Yarbo Lawn Mower](https://junglewise.ai/threats/technologies/lawn-mower), [Yarbo Lawn Mower Firmware](https://junglewise.ai/threats/technologies/lawn-mower-firmware), [Yarbo Lawn Mower Pro](https://junglewise.ai/threats/technologies/lawn-mower-pro), [Yarbo Lawn Mower Pro Firmware](https://junglewise.ai/threats/technologies/lawn-mower-pro-firmware). Vendors: [Yarbo](https://junglewise.ai/threats/vendors/yarbo).

## Quick answers

**Is CVE-2026-7414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7414 being exploited in the wild.

**How severe is CVE-2026-7414?** Critical severity, with a CVSS score of 9.8, published 7 May 2026.

**Which products and versions are affected?** Yarbo Lawn Mower Firmware 2.3.9; Yarbo Lawn Mower Pro Firmware 2.3.9.

**Is there a fix for CVE-2026-7414?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7414 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-7414?** Check whether you run Yarbo Lawn Mower, Yarbo Lawn Mower Firmware, Yarbo Lawn Mower Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use of hard-coded credentials (CWE-798) exists in Yarbo firmware version 2.3.9. The firmware image contains static administrative credentials that are shared across the entire product line and cannot be modified or deleted by the end user. An attacker with network access to the device's management interface can use these credentials to gain full administrative privileges. This vulnerability was identified through static analysis of the Android APK and filesystem dumps from physical robot hardware. No patch has been reported in the advisory.

## Affected products

- Yarbo Lawn Mower firmware 2.3.9
- Yarbo Lawn Mower Pro firmware 2.3.9

## Timeline

- 2026-05-07: disclosed: Vulnerability reported by Andreas Makris via Austin Hackers Anonymous.
- 2026-05-07: advisory: CVE-2026-7414 published.

## References

- [https://github.com/Bin4ry/yarbo-nat-in-my-back-yard](https://github.com/Bin4ry/yarbo-nat-in-my-back-yard)
- [https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000](https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000)
- [https://github.com/Bin4ry/yarbo-nat-in-my-back-yard](https://github.com/Bin4ry/yarbo-nat-in-my-back-yard)

## Related threats

- [Yarbo Firmware missing authentication in MQTT broker](https://junglewise.ai/threats/cve-2026-7415-yarbo-firmware-missing-authentication-in-mqtt-broker)
- [Yarbo Lawn Mower firmware persistent backdoor in SSH service](https://junglewise.ai/threats/cve-2026-7413-yarbo-lawn-mower-firmware-persistent-backdoor-in-ssh-service)