{“lastseen”:”2026-05-11T14:05:08″,”description”:”A researcher found that Yarbo yard robots came with a host of vulnerabilities which, among others, allowed an attacker to harvest WiFi passwords.\\n\\nSecurity researcher Andreas Makris found he could remotely hijack thousands of Yarbo yard robots worldwide, and proved it by having his mower run him over. The root cause was a cluster of \u201clegacy\u201d design choices: every robot shared the same hardcoded root password, remote tunnels were left open, and Message Queuing Telemetry Transport (MQTT) messaging was so weakly protected that once you had one device, you effectively had the worldwide fleet.\\n\\nAn attacker could pull GPS coordinates, email addresses, and Wi\u2011Fi passwords, turn cameras into remote spying tools, and even re\u2011arm the mower after someone hit the emergency stop. \\n\\nAll of this was enabled by a persistent backdoor tunnel that users could neither see nor meaningfully control. The risks fell into three very different buckets:\\n\\n * A heavy mower with remotely controllable blades and an emergency stop that can be bypassed is a real-world safety hazard.\\n * Exposed telemetry meant attackers could map where devices were, see who owned them, and in some reports even view camera feeds.\\n * Network abuse through shared root credentials meant compromised robots could scan local networks, steal more data, or be folded into a botnet.\\n\\n\\n\\nYarbo\u2019s public response is unusually detailed for a consumer Internet of Things (IoT) vendor. It\u2019s also refreshingly blunt in admitting that the researcher\u2019s core findings were accurate. The company temporarily disabled the remote diagnostic tunnels, reset root passwords, locked down unauthenticated endpoints, and began ripping out unnecessary legacy access paths.\\n\\nMore importantly, Yarbo promises structural changes:\\n\\n * Unique per\u2011device credentials.\\n * Over-the-Air (OTA) credential rotation.\\n * Audited, allowlist\u2011based remote diagnostics.\\n * Dedicated security contact, with a possible bug bounty to follow.\\n\\n\\n\\nThat is the sort of long\u2011term security hygiene we rarely see spelled out this clearly after an IoT fiasco.\\n\\nFrom a disclosure and remediation standpoint, Yarbo is doing many things right: crediting the researcher, apologizing, prioritizing fixes, and explaining both short\u2011term patches and long\u2011term architectural changes in human language. For buyers of connected devices with blades, that level of transparency is a positive precedent.\\n\\nBut Yarbo has explicitly chosen to keep a remote access tunnel, although wrapped in better controls and logs, instead of offering users the option to remove or fully opt out of it.\\n\\n## How to secure IoT devices\\n\\nThe vulnerabilities uncovered in the Yarbo case present an almost a live-action demo of what the IoT Cybersecurity Improvement Act is trying to prevent in US government deployments. While the Act doesn\u2019t apply to Yarbo directly, its National Institute of Standards and Technology (NIST)-driven requirements map neatly onto what went wrong here.\\n\\nSo, it\u2019s still up to users to make sure you:\\n\\n * Change the default credentials.\\n * Check if the vendor will make updates available and how easy it is to install them before buying an IoT product. And then install the updates when available.\\n * If you can, put your IoT devices on a separate network. Use a guest Wi\u2011Fi or separate VLAN when available.\\n * Disable what you don’t need. Turn off UPnP, remote access, cloud control, and unnecessary services if you’re not actively using them.\\n * If your router or security suite logs connections from IoT devices, skim those logs for odd spikes or unknown destinations.\\n\\n\\n\\n* * *\\n\\n****Let ‘s face it, an incognito window can only do so much.** \\n \\n**Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.”,”published”:”2026-05-11T13:21:57″,”modified”:”2026-05-11T13:21:57″,”type”:”malwarebytes”,”title”:”Yarbo responds to robot flaws that could mow down their owners”,”source”:””,”references”:””,”id”:”MALWAREBYTES:49B29ABA09490928A167FF4332A523FA”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2026\/05\/yarbo-responds-to-robot-flaws-that-could-mow-down-their-owners”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T14:05:08″,”description”:”A researcher found that Yarbo yard robots came with a host of vulnerabilities which, among others, allowed an attacker to harvest WiFi passwords.\\n\\nSecurity researcher Andreas…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-52980","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n