PT-2026-140448

CVE-2026-121687

Published

2026-11-09

Updated

2026-11-09

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

FrodoBots EarthRover Mini+ firmware (version 6.2.4 6.2.5 0.614.0) contains several local interfaces that are exposed without authentication.

HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.
ADB (Android Debug Bridge, port 5555) access to root shell
SSH (port 22)

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾