CVE-2026-121686: FrodoBots EarthRover Mini+ firmware vulnerability

Published Nov 9, 2026

Updated

FrodoBots EarthRover Mini+ firmware (version 6.2.46.2.50.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.

Affected Software

1 affected component

FrodoBots EarthRover Mini+ firmware=6.2.4_6.2.5_0.614.0

Event History

Nov 9, 2026

CVE Published

via NVD·05:17 PM

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs access to the shared IoT credentials used for AWS IoT MQTT messaging. No per-device authentication is required once those shared credentials are available.

Which devices are exposed?

Devices running FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 are affected. Because the credentials are shared rather than unique per device, compromise of those credentials can enable access across the fleet.

What level of access can exploitation provide?

Arbitrary shell commands delivered through AWS IoT MQTT messages are executed as root. Successful exploitation therefore gives the attacker remote root-level code execution on affected devices.

CVE-2026-121686: FrodoBots EarthRover Mini+ firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which devices are exposed?

What level of access can exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which devices are exposed?

What level of access can exploitation provide?