Search: CVE-2026-121690

FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 runs all processes with root privileges, lacking privilege separation. This design flaw means that compromising any single service grants full administrative control over the device.

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 allow remote code execution, unauthorized sensor access, sensitive data disclosure, and full device compromise. Exploits include hard-coded credentials, unauthenticated remote command execution via MQTT, exposed local interfaces without authentication, insecure firmware update mechanisms, and excessive privilege execution. These flaws enable attackers to control the rover remotely, access audiovisual streams, extract Wi-Fi credentials, and potentially pivot into the local network. The vendor has addressed the highest-impact issues and is developing a firmware update to remediate remaining concerns. Interim mitigation includes operating the device on trusted private networks only.