CVE-2026-7413
Published: 07 May 2026
Summary
CVE-2026-7413 is a high-severity Hidden Functionality (CWE-912) vulnerability in Yarbo Lawn Mower Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 43.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-28398
Vulnerability details
A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Backdoor in firmware directly provides remote unauthenticated privileged access (T1133) and establishes persistent foothold via system firmware (T1542.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.
Recovery eliminates hidden functionality or backdoors introduced during compromise.
Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.
Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.
Hunting identifies hidden functionality used for persistence or evasion after initial compromise.
TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.
Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.
Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.