Executive brief
The Yarbo robotic lawn mower contains a security flaw in its internal communication system. An attacker on the same network can connect to the robot without a password to monitor its status or send unauthorized commands. This could allow an unauthorized person to take control of the robot's movements or access sensitive operational data.
Technical details
The embedded MQTT broker in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write Access Control Lists (ACLs). This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), allows any host on the same network to connect to the broker. Once connected, an attacker can subscribe to sensitive telemetry topics to leak data or publish control messages to the robot to influence its behavior. The issue was identified through static analysis of the Android APK and a filesystem dump of the robot's firmware.
Affected products
- Yarbo Lawn Mower firmware 2.3.9
- Yarbo Lawn Mower Pro firmware 2.3.9
Timeline
- 2026-05-07: disclosed
- 2026-05-07: advisory