Loading story…
Thousands of internet-connected Yarbo robotic lawnmowers were exposed to remote compromise after researcher Andreas Makris found identical default administrator credentials across the fleet, enabling access to owner email addresses, Wi-Fi passwords, and precise GPS locations. Reports said more than 11,000 devices in over 30 countries were reachable, and a live demonstration showed a 200-pound mower outside a family home in New York being remotely controlled from Germany, raising concerns that attackers could override local controls, activate blades, or use onboard cameras for surveillance.
Makris' published research alleged the problem extended beyond shared passwords to a broader remote-access architecture, including fleet-wide root SSH access through FRP NAT traversal tunnels, shared MQTT credentials, an unauthenticated robot-shadow API exposing device state and location by serial number, and plaintext developer credentials in production mobile apps. Yarbo said it disabled remote diagnostic tunnels, reset root passwords, and moved to device-specific credentials, but researchers warned that retained manufacturer remote access could still function like a backdoor and leave the Linux-based devices usable for botnets, network intrusion, or attacks near sensitive sites such as critical infrastructure.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Following the disclosure, Yarbo said it disabled remote diagnostic tunnels, reset root passwords, and moved to device-specific credentials. Researchers said these steps did not fully resolve concerns because manufacturer remote access allegedly remained possible.
As part of the public disclosure reported on 2026-05-15, Makris demonstrated remote control of a 200-pound Yarbo mower in upstate New York from Germany. The demonstration showed an outsider could override local controls and potentially abuse onboard cameras and other connected features.
By 2026-05-15, reporting on Makris's findings said thousands of Yarbo robotic lawnmowers worldwide were remotely compromisable because they used identical default administrator credentials. The disclosure said more than 11,000 exposed devices were mapped across over 30 countries and that sensitive data including owner email addresses, Wi-Fi passwords, and precise GPS locations could be accessed.
On 2026-05-11, Yarbo said it would completely remove the intentional remote backdoor from its robots after public security concerns. The company said any future remote diagnostic capability would instead be an optional opt-in feature for customers.
On 2026-05-07, security researcher Andreas Makris published a report alleging Yarbo autonomous lawn and snow robots exposed fleet-wide root SSH access through FRP NAT traversal tunnels, a hardcoded root password, shared MQTT credentials, and an unauthenticated API leaking device state and GPS data. The report estimated roughly 6,000 affected robots and warned of risks including unauthorized robot control, camera access, Wi-Fi credential theft, and lateral movement into local networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
10 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourcekaspersky.ru
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcegithub.com
Open sourceeu.yarbo.com
Open sourceeu.yarbo.com
Open sourceforum.yarbo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued multiple ICS advisories covering **Brickcom cameras**, the **Yarbo** mobile app and cloud MQTT infrastructure, and the **Naxclow IoT Platform**, warning that weak authentication, default credentials, and hard-coded secrets could expose connected devices to takeover and surveillance. The Brickcom advisory said affected Cube, Dome, Bullet, and Box cameras running version `3.2.3.5.6` allow unauthenticated access to live snapshots through the `/ONVIF` endpoint and may ship with default credentials that permit administrative control and silent viewing of camera feeds. In Yarbo’s case, hard-coded MQTT broker credentials embedded in Android and iOS apps, combined with missing cloud authorization checks, could let attackers access telemetry from the global robot fleet and potentially issue commands to any robot using only its serial number. CISA also detailed multiple vulnerabilities across all versions of Naxclow products including the **Smart Doorbell X3**, **X Smart Home**, **V720**, and **ix cam**, where authorization bypasses, predictable device identifiers, exposed relay credentials, and an exposed UART console could enable impersonation, fleet enumeration, interception of communications, and theft of Wi-Fi credentials. The most severe Naxclow issue, **`CVE-2026-28742`**, stems from a hard-coded platform-wide salt used for request signing and carries a **CVSS 9.8** rating because a secret extracted from one device could be used to forge requests across the platform. Reporting indicates Naxclow had not responded and no official patch was available, while CISA said it had no evidence of public exploitation for any of the disclosed issues and urged organizations to reduce internet exposure, segment networks, and use secure remote access controls.
Jun 29, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
Security researchers reported serious Bluetooth security weaknesses in personal mobility devices that allow unauthorized control at close range. An Estonian researcher reverse-engineered Äike’s app-controlled e-scooters after the company’s bankruptcy and alleged the scooters shipped with a single default/private “master” key rather than unique per-device secrets, enabling anyone who derives the key to generate valid challenge-response authentication and unlock/control any scooter model the company sold. Separately, researchers demonstrated remote control of **WHILL** wheelchairs over Bluetooth, prompting a **CISA advisory** stating the devices did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles—highlighting a broader risk pattern where weak or missing Bluetooth authentication in mobility/IoT products can translate directly into physical safety impacts.
Jun 29, 2026