CVE-2026-7414
published 2026-05-07CVE-2026-7414: Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.53%
40.8th percentile
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yarbo | firmware | <= 2.3.9 | — |
| yarbo | lawn_mower_firmware | — | — |
| yarbo | lawn_mower_pro_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Yarbo up to 2.3.9 hard-coded credentials
vuldb·2026-05-07·CVSS 9.8
CVE-2026-7414 [CRITICAL] Yarbo up to 2.3.9 hard-coded credentials
A vulnerability marked as critical has been reported in Yarbo up to 2.3.9. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in hard-coded credentials.
This vulnerability is identified as CVE-2026-7414. The attack can be initiated remotely. There is not any exploit available.
GHSA
GHSA-vw42-99fw-3p5g: Yarbo firmware v2
ghsa_unreviewed·2026-05-07
CVE-2026-7414 [CRITICAL] CWE-798 GHSA-vw42-99fw-3p5g: Yarbo firmware v2
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Bin4ry/yarbo-nat-in-my-back-yardhttps://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001111111111100011111111111000000000000000000000000000000000000000000000000000001000https://github.com/Bin4ry/yarbo-nat-in-my-back-yard#3--hardcoded-developer-credentials-in-production-apk
2026-05-07
Published