Yarbo robot mowers contain a deliberate backdoor that provides remote root access via a hardcoded universal password embedded in the firmware. This password is identical on all devices and resets to the default after updates, preventing permanent user mitigation. The backdoor allows attackers to execute arbitrary commands, stream video from built-in cameras, capture photos, harvest user emails and Wi-Fi credentials, and control the mower remotely. The researcher demonstrated remote hijacking, including steering the mower toward a person. Yarbo has issued firmware updates to remove universal passwords and make remote access opt-in, but the completeness of the fix remains uncertain.

Attackers can gain full administrative control over Yarbo robot mowers remotely without user interaction, enabling spying via cameras, theft of sensitive user data (emails, Wi-Fi passwords), precise location tracking, and physical control of a heavy machine capable of causing harm. The backdoor is persistent due to the hardcoded password resetting after updates, exposing all devices globally. This compromises user privacy, physical safety, and network security by potentially serving as a foothold for further attacks.

Yarbo has released firmware updates that remove the universal root password, implement stronger access controls, and make remote access strictly opt-in. Users should immediately install these updates. Since the backdoor was intentionally built and the password resets after updates, users cannot fully mitigate the risk without applying vendor patches. Monitor vendor advisories for confirmation of complete remediation. No other user actions can disable the backdoor or prevent reset of the password.