CVE-2026-121685

Name of the Vulnerable Software and Affected Versions FrodoBots EarthRover Mini+ version 6.2.4 6.2.5 0.614.0

Description The firmware contains multiple sets of hard-coded credentials embedded directly in the frodobot.bin file, which can be accessed via static analysis of the publicly downloadable firmware without special privileges. These include fleet-wide BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. This flaw allows an attacker to authenticate to backend services and the device, potentially leading to remote code execution, unauthorized sensor access, data disclosure, and full device compromise. An attacker could remotely control the rover, access live audio and video streams, and use the device as a foothold to pivot into the local network.

Recommendations Disconnect the device until a firmware update is released that removes hardcoded secrets and implements proper credential rotation. Isolate the device on a dedicated VLAN with no egress to internal resources. Block outbound traffic to unknown AWS and Agora endpoints at the firewall.