Search: CVE-2026-121686

FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains an unauthenticated remote code execution vulnerability via MQTT. The firmware accepts arbitrary shell commands through AWS IoT MQTT messages and executes them as root. Access control relies solely on shared IoT credentials without per-device authentication, allowing potential remote root code execution across devices.

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 allow remote code execution, unauthorized sensor access, sensitive data disclosure, and full device compromise. Exploits include hard-coded credentials, unauthenticated remote command execution via MQTT, exposed local interfaces without authentication, insecure firmware update mechanisms, and excessive privilege execution. These flaws enable attackers to control the rover remotely, access audiovisual streams, extract Wi-Fi credentials, and potentially pivot into the local network. The vendor has addressed the highest-impact issues and is developing a firmware update to remediate remaining concerns. Interim mitigation includes operating the device on trusted private networks only.