FrodoBots EarthRover Mini+ firmware flaws enable remote root control
Original title: VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities
Hard-coded AWS and MQTT credentials enable fleet-wide root commands; the vendor says fixes are in the latest firmware.
FrodoBots EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0 contains fleet-wide hard-coded cloud credentials and an MQTT method that executes arbitrary shell commands as root. Other flaws expose local HTTP, ADB, and SSH services, disclose Wi-Fi passwords, and fetch STM32 motor firmware over HTTP with only an MD5 check. The vendor says the issues are fixed, mitigated, or not remotely exploitable under the current deployment model. Users are told to install the latest firmware; no fixed version number is given.
Unconfirmed: The vendor’s claim that local issues are not remotely exploitable rests on its deployment model and internal review.
- CVE-2026-121685 covers hard-coded Agora, AWS IAM, AWS IoT MQTT, and Slack credentials.
- CVE-2026-121686 runs shell commands as root using only shared IoT credentials.
- Unauthenticated services include HTTP on port 80, ADB on 5555, and SSH on 22.
- The vendor says arbitrary shell execution was removed and most embedded credentials deleted.
- The vendor says local flaws require joining the rover’s password-protected Wi-Fi access point.
Impact: Remote root control, sensor access, and Wi-Fi credential disclosure
| Product | Affected |
|---|---|
| FrodoBots EarthRover Mini+ | 6.2.4_6.2.5_0.614.0 |
- 1.Update FrodoBots EarthRover Mini+ devices to the latest firmware.
- Vendors
- FrodoBots
- Products
- EarthRover Mini+
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121685 | — | — | — | ||
| CVE-2026-121686 | — | — | — | ||
| CVE-2026-121687 | — | — | — | ||
| CVE-2026-121688 | — | — | — | ||
| CVE-2026-121689 | — | — | — | ||
| CVE-2026-121690 | — | — | — |
From the original article
5 min read at kb.cert.orgOverview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6. 2. 4_6.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.