Yarbo Android/iOS Mobile Application and Cloud Infrastructure

Summary

Vulnerabilities 2

• Critical 9.8
  CVE-2026-10557

  Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

  The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials pro…

  Yarbo Yarbo Cloud MQTT infrastructure Yarbo Android/IOS mobile application Android iOS
  Jun 12, 2026
• High 8.1
  CVE-2026-7368

  Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization

  The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and ca…

  Yarbo Yarbo Cloud MQTT infrastructure Yarbo Android/IOS mobile application Android iOS
  Jun 12, 2026

Revision history

1. 2026-06-11 #1

   Initial Publication

References

• ICSA Advisory ICSA-26-162-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks