Home

Description

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

PUBLISHED Reserved 2026-04-28 | Published 2026-06-12 | Updated 2026-06-12 | Assigner icscert




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

Any version before 3.17.4
affected

Default status
unaffected

All (custom)
affected

Credits

Markus Lassfolk of Truesec reported this vulnerability to CISA. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-26-162-01

github.com/...p/csaf_files/OT/white/2026/icsa-26-162-01.json

cve.org (CVE-2026-7368)

nvd.nist.gov (CVE-2026-7368)

Download JSON