Search: CVE-2026-121688

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has an insecure firmware update mechanism. The STM32 motor-controller firmware is downloaded over unencrypted HTTP, and integrity is only checked using MD5 with the hash provided in the same unprotected response. There is no code-signing implemented, which allows an attacker to replace the firmware with malicious code.

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 allow remote code execution, unauthorized sensor access, sensitive data disclosure, and full device compromise. Exploits include hard-coded credentials, unauthenticated remote command execution via MQTT, exposed local interfaces without authentication, insecure firmware update mechanisms, and excessive privilege execution. These flaws enable attackers to control the rover remotely, access audiovisual streams, extract Wi-Fi credentials, and potentially pivot into the local network. The vendor has addressed the highest-impact issues and is developing a firmware update to remediate remaining concerns. Interim mitigation includes operating the device on trusted private networks only.