CVE-2026-121685: FrodoBots EarthRover Mini+ firmware vulnerability

Published Nov 9, 2026

Updated

FrodoBots EarthRover Mini+ firmware (version 6.2.46.2.50.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.

Affected Software

1 affected component

FrodoBots EarthRover Mini+ firmware=6.2.4_6.2.5_0.614.0

Event History

Nov 9, 2026

CVE Published

via NVD·05:17 PM

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

What does an attacker need to extract the exposed credentials?

An attacker only needs access to the publicly downloadable firmware image. The credentials are embedded in frodobot.bin and can be obtained through static analysis without special privileges or access to a device.

Which services or functions may be exposed by the embedded secrets?

The firmware contains fleet-wide Basic Authentication credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. Exposure may therefore extend beyond an individual device to services shared across the fleet.

Are affected systems exposed under the default firmware configuration?

The credentials are embedded directly in the affected firmware image, so their exposure does not depend on a local configuration change. Any deployment using the identified firmware version contains the hard-coded values in its firmware binary.

How can I determine whether my deployment is affected?

Check whether EarthRover Mini+ devices use firmware version 6.2.4_6.2.5_0.614.0. You can also inspect the deployed or downloadable frodobot.bin image for the embedded credential sets.

CVE-2026-121685: FrodoBots EarthRover Mini+ firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to extract the exposed credentials?

Which services or functions may be exposed by the embedded secrets?

Are affected systems exposed under the default firmware configuration?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to extract the exposed credentials?

Which services or functions may be exposed by the embedded secrets?

Are affected systems exposed under the default firmware configuration?

How can I determine whether my deployment is affected?