CVE-2026-7414 | Yarbo firmware v2.3.9 contains hardcoded administrative cred… | CVSS 9.8 CRITICAL

Description

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

Metadata

CVE ID: CVE-2026-7414
State: PUBLISHED
Assigner: AHA
Reserved: 2026-04-29 13:55 UTC
Published: 2026-05-07 16:10 UTC
Last updated: 2026-05-07 17:01 UTC
Primary CWE: CWE-798
CWE-798 Use of Hard-coded Credentials
Vendor / Product: Yarbo / Firmware
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Yarbo	Firmware	—	0 ≤ 2.3.9

Weakness (CWE)

CWE	Source	Description
CWE-798	cna	CWE-798 Use of Hard-coded Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)