CVE-2026-7413 is a high severity (CVSS 7.2) hidden backdoor in Yarbo robot firmware v2.3.9. The record says it gives privileged remote access, cannot be turned off in settings, and survives factory reset and ordinary updates. No fix is confirmed, so isolate the devices.
What's affected
The record lists Yarbo lawn mower and lawn mower pro products and their firmware, version 2.3.9 from April 2026. The AHA! disclosure names Yarbo robot firmware v2.3.9 as affected.
I could not confirm a fixed firmware. The source says the component is restored during normal boot, so an ordinary update is not expected to remove it. Ask the manufacturer for a statement and a remediation path.
The AHA! write-up also mentions a related hardcoded credential issue, CVE-2026-7414, which together with this one is described as giving effectively unrestricted access.
How to check if you're exposed
Open the Yarbo app or device settings and read the firmware version. If it is 2.3.9, you are in scope.
Then look at how the device connects. The disclosure describes an SSH service reachable through the vendor's NAT-punching proxy system, so the device may be reachable even behind a home or business router. A network monitoring tool or router log can show unexpected outbound connections from the device.
What to do now
- Find any Yarbo devices on your networks and read their firmware versions.
- Put them on an isolated network or guest VLAN with no access to your other systems.
- Contact the manufacturer and ask for a fix and a statement about the backdoor.
- Restrict the device's outbound connections to what it needs, if your router allows.
- Avoid storing sensitive data or credentials on the device, and consider powering it down if you cannot isolate it.
Why it matters
The record maps this to CWE-912, hidden functionality. Hidden functionality is a feature that is not documented and cannot be disabled by the owner. An undocumented administrative service with privileged access is the textbook example, because the owner cannot defend what they do not know exists.
The disclosure rates the attack as needing valid credentials for the service, which is why the vector lists high privileges required, but it also describes a hardcoded credential problem in a companion CVE. The same source says a proof of concept exists. The record's KEV flag is false.
Connected consumer and field devices often have long lifetimes and weak update paths. Network isolation is the control you have when the vendor's fix is unclear.
Quick check
Will a factory reset remove the backdoor?
The record says it survives factory reset and ordinary firmware updates, so do not rely on that.
Sources
Last reviewed: 19 October 2026.
