Back to overview

CVE-2026-10557

CRITICAL
9.8
CVSS 3.1
Description
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

Metadata

CVE ID
CVE-2026-10557
State
PUBLISHED
Assigner
icscert
Reserved
2026-06-01 14:53 UTC
Published
2026-06-12 14:05 UTC
Last updated
2026-06-12 15:35 UTC
Primary CWE
CWE-798
CWE-798 Use of Hard-coded Credentials
Vendor / Product
Yarbo / Yarbo Android/IOS mobile application
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
Yarbo Yarbo Android/IOS mobile application — 0 < 3.17.4
Yarbo Yarbo Cloud MQTT infrastructure — All
Weakness (CWE)
CWESourceDescription
CWE-798 cna CWE-798 Use of Hard-coded Credentials
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (2)
Back to overview