CERT/CC finds flaws enabling remote root access to FrodoBots

CERT/CC disclosed six FrodoBots EarthRover vulnerabilities on 9 November 2026 affecting EarthRover Mini+ devices running firmware 6.2.4_6.2.5_0.614.0. The fleet‑scale flaws could allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information and full compromise of affected units, according to CERT/CC.

The report notes that hard-coded cloud keys and an MQTT command channel enabled attackers to execute root commands across the fleet; FrodoBots has since revoked the leaked keys and limited remote commands to individual devices, with a broader firmware update described as still in development and internal testing.

The six CVEs span both remote fleet‑wide and local‑access flaws. CERT/CC highlights CVE-2026-121685 (fleet‑wide AWS/MQTT credentials embedded in the public firmware) and CVE-2026-121686 (command channel that can run as root with no per‑device check). Local issues include CVE-2026-121687 (web API, ADB root shell and SSH lacking proper login) and CVE-2026-121688 (motor‑controller update transmitted over HTTP with only an MD5 check).

Additional problems cover CVE-2026-121689 (Wi‑Fi password stored in plaintext) and CVE-2026-121690 (all processes running as root). FrodoBots states there is no evidence vendor infrastructure or third‑party devices were accessed and that no public exploit has been reported to date; the firm urges owners to operate on trusted networks and apply forthcoming firmware updates when available.