Search: CVE-2026-121687

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 exposes several local interfaces without authentication, including an HTTP REST API, ADB root shell access, and SSH. These unauthenticated interfaces allow access to critical functions such as motor control, telemetry data, WiFi credentials, and diagnostic exports.

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 allow remote code execution, unauthorized sensor access, sensitive data disclosure, and full device compromise. Exploits include hard-coded credentials, unauthenticated remote command execution via MQTT, exposed local interfaces without authentication, insecure firmware update mechanisms, and excessive privilege execution. These flaws enable attackers to control the rover remotely, access audiovisual streams, extract Wi-Fi credentials, and potentially pivot into the local network. The vendor has addressed the highest-impact issues and is developing a firmware update to remediate remaining concerns. Interim mitigation includes operating the device on trusted private networks only.