CVE-2026-7413

Persistent undocumented backdoor access in Yarbo robot

7.2 High

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.58%Up 0.6 points since May 8, 2026

What each source reports

CVE List Score used 7.2

Persistent undocumented backdoor access in Yarbo robot

Record: CVE-2026-7413
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-912
Updated: 2026-11-02

EUVDEUVD-2026-28398 7.2

Record: EUVD-2026-28398
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pq5m-hxx2-xhw5 7.2

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote,...

Record: GHSA-pq5m-hxx2-xhw5
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-912
Updated: 2026-11-02

NVD 7.2

Record: CVE-2026-7413
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-912
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-7413 is a high vulnerability (CVSS 7.2) in Yarbo Firmware, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. No source names a fixed version.