FrodoBots EarthRover Mini+ firmware flaws enable remote root control
Hard-coded AWS and MQTT credentials enable fleet-wide root commands; the vendor says fixes are in the latest firmware.
56
CVE-2026-121689
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.