The MQTT broker in Yarbo firmware v2.3.9 lacks authentication and authorization controls, allowing anonymous network hosts to access sensitive telemetry topics and publish control commands. This missing authentication for critical functions (CWE-306) enables unauthorized read and write operations on the robot via MQTT, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is network exploitable without privileges or user interaction, reflected in a CVSS 3.1 base score of 9.8.

An attacker on the same network can connect anonymously to the MQTT broker and subscribe to sensitive telemetry data or send arbitrary control messages to the robot. This can lead to full compromise of the robot's confidentiality, integrity, and availability, including unauthorized data disclosure, manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device to trusted hosts only and consider isolating the device on a separate network segment to prevent unauthorized MQTT connections.