FrodoBots EarthRover Mini+ firmware flaws enable remote root control
Hard-coded AWS and MQTT credentials enable fleet-wide root commands; the vendor says fixes are in the latest firmware.
56
CVE-2026-121685
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.