MalwarePublished 2 Jul 2026

The unpatchable backdoor in Yarbo robot mowers | Kaspersky official blog

Source Kaspersky Security Blog

remote

Description

A security researcher discovered a remote access exploit in Yarbo robot mowers, granting full control over the machines and user data.

Impact

Attackers can gain full administrative control over Yarbo robot mowers remotely without user interaction, enabling spying via cameras, theft of sensitive user data (emails, Wi-Fi passwords), precise location tracking, and physical control of a heavy machine capable of causing harm. The backdoor is persistent due to the hardcoded password resetting after updates, exposing all devices globally. This compromises user privacy, physical safety, and network security by potentially serving as a foothold for further attacks.

Defensive guidance

Yarbo has released firmware updates that remove the universal root password, implement stronger access controls, and make remote access strictly opt-in. Users should immediately install these updates. Since the backdoor was intentionally built and the password resets after updates, users cannot fully mitigate the risk without applying vendor patches. Monitor vendor advisories for confirmation of complete remediation. No other user actions can disable the backdoor or prevent reset of the password.

Summary

Yarbo robot mowers contain a deliberate backdoor that provides remote root access via a hardcoded universal password embedded in the firmware. This password is identical on all devices and resets to the default after updates, preventing permanent user mitigation. The backdoor allows attackers to execute arbitrary commands, stream video from built-in cameras, capture photos, harvest user emails and Wi-Fi credentials, and control the mower remotely. The researcher demonstrated remote hijacking, including steering the mower toward a person. Yarbo has issued firmware updates to remove universal passwords and make remote access opt-in, but the completeness of the fix remains uncertain.

References

kaspersky.com/blog/yarbo-robot-lawn-mower-hacked-2/56067/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jul 2026, 01:19 UTC

References

Community reviews

Related threats