Yarbo Android/iOS Mobile Application and Cloud Infrastructure
CISA says Yarbo's mobile app and cloud MQTT system exposed hard-coded credentials and weak authorization, risking fleet-wide access.
Intelligence analysis by GPT-5.4 Mini
CISA published an ICS advisory on Yarbo's Android/iOS app and cloud infrastructure after finding critical flaws that could expose telemetry and let an attacker send commands to robots. The vendor says an app update and a server-side authorization fix are available or forthcoming.
CISA found that Yarbo's app was using one shared key for everyone, like giving every house the same front door code. That could let an intruder peek at robot data and maybe even send robot commands.
Analysis
What CISA found
CISA says Yarbo's Android and iOS app contains hard-coded MQTT broker credentials that are the same for all users and devices. The agency says those credentials are embedded in the app binary and can be extracted by decompiling the APK. Once obtained, they can be used to access cloud MQTT brokers that carry real-time telemetry for the global Yarbo robot fleet.
What an attacker could do
According to the advisory, the credentials allow wildcard subscription to robot telemetry topics and publishing to robot command topics using only a robot's serial number. CISA also says Yarbo's cloud does not enforce per-device or per-user authorization, so even legitimate credentials can provide fleet-wide access if the backend does not distinguish between devices.
Severity and scope
CISA lists CVE-2026-10557 for the hard-coded credentials issue and CVE-2026-7368 for missing authorization. Both are scored critical or high, with the first reaching CVSS 9.8. The affected versions include Yarbo Android/iOS mobile application versions below 3.17.4 and the Yarbo Cloud MQTT infrastructure.
Mitigation
Yarbo recommends updating the mobile app to 3.17.4 or later. The advisory also says server-side broker authorization will be enforced automatically with the May 2026 update, and that no user action is required for that backend change. CISA separately advises minimizing network exposure for control system devices, isolating them behind firewalls, and using secure remote access methods when needed.
Bottom line
The core problem is simple but serious: one shared set of credentials and weak backend controls can expose an entire fleet. In an industrial-control setting, that raises both confidentiality and operational safety risks.
Key points
- CISA says Yarbo's mobile app contained hard-coded MQTT broker credentials shared across users and devices.
- The advisory says the cloud MQTT infrastructure did not enforce per-device or per-user authorization.
- An attacker could potentially read fleet telemetry and publish commands to robot topics using a serial number.
- CISA assigns the issues CVE-2026-10557 and CVE-2026-7368, with critical and high severity scores.
- Yarbo recommends updating the app to 3.17.4 or later and says a backend authorization update is planned.
Yarbo says users can update the app to version 3.17.4 or later, and the company says server-side broker authorization will be enforced in a May 2026 update. If those fixes are fully deployed, the shared-credential exposure and fleet-wide access risk should drop sharply.
If users delay the app update or the backend rollout is incomplete, the exposed broker path could remain usable. CISA also notes that even after hard-coded credentials are removed, a single compromised credential could still enable broad access if per-device controls are not enforced.
