Yarbo Firmware vulnerabilities

• meshtastic firmware Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure CVE-2026-42566 7.5 HighJuly 19, 2026
• meshtastic firmware Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow CVE-2026-44359 10.0 CriticalJuly 19, 2026
• tenda firmware Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface CVE-2026-11405 Public exploit 9.8 CriticalJuly 6, 2026
• yarbo firmware, lawn mower firmware, lawn mower pro firmware +2 more Open MQTT orchestration without read/write ACLs in Yarbo robot firmware CVE-2026-7415 9.8 CriticalMay 7, 2026
• yarbo firmware, lawn mower firmware, lawn mower pro firmware +2 more Hardcoded credentials in Yarbo robot firmware CVE-2026-7414 9.8 CriticalMay 7, 2026
• yarbo firmware, lawn mower firmware, lawn mower pro firmware +2 more Persistent undocumented backdoor access in Yarbo robot CVE-2026-7413 7.2 HighMay 7, 2026
• meshtastic firmware In Meshtastic, an attacker can spoof licensed amateur flag for a node CVE-2025-55292 8.2 HighJanuary 27, 2026
• meshtastic firmware Meshtastic firmware allows forged DMs with no PKC to show up as encrypted CVE-2025-53627 5.3 MediumDecember 29, 2025
• meshtastic firmware Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB CVE-2025-55293 9.4 CriticalAugust 18, 2025
• meshtastic firmware Traceroute_APP responses are not rate-limited. CVE-2024-47065 2.7 LowJuly 11, 2025
• meshtastic firmware Meshtastic allows Command Injection in GitHub Action CVE-2025-53637 4.1 MediumJuly 10, 2025
• meshtastic firmware Meshtastic crashes via an unimplemented routing module reply CVE-2025-24798 4.3 MediumJuly 10, 2025
• meshtastic firmware Meshtastic Repeated Public and Private Keypairs CVE-2025-52464 Public exploit 9.5 CriticalJune 19, 2025
• meshtastic firmware Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow CVE-2025-24797 Public exploit 9.4 CriticalApril 14, 2025
• meshtastic firmware Forged packets over MQTT can show up in direct messages in Meshtastic firmware CVE-2025-21608 5.3 MediumFebruary 18, 2025
• meshtastic firmware Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware CVE-2024-51500 5.3 MediumNovember 4, 2024
• meshtastic firmware Unauthorized usage of remote hardware module because of missing channel verification CVE-2024-47079 6.4 MediumOctober 7, 2024
• meshtastic firmware Meshtastic firmware Authentication/Authorization Bypass via MQTT CVE-2024-47078 8.1 HighSeptember 25, 2024
• meshtastic firmware Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware CVE-2024-45038 7.5 HighAugust 27, 2024