CVE-2026-10557

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1055706.7Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while CVE-2026-1055717.3A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMCVE-2026-1055724.3A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the coCVE-2026-1055734.3A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updatCVE-2026-105586.3A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is an unknown function of the file /admin/index.php. PCVE-2026-105596.3A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. ExCVE-2026-1055918.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1055927.5Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1055938.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1055958.8Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1055968.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1055978.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.