CVE-2026-121685: CVE-2026-121685
FrodoBots · FrodoBots EarthRover Mini+ firmware
No fix listed · Affected: FrodoBots EarthRover Mini+ firmware · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 11% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- CERT/CC finds flaws enabling remote root access to FrodoBotsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.