CVE-2026-121687: FrodoBots EarthRover Mini+ firmware vulnerability
FrodoBots EarthRover Mini+ firmware (version 6.2.46.2.50.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22)
Affected Software
Event History
Frequently Asked Questions
What network access does an attacker need to exploit these interfaces?
An attacker needs network reachability to the device's exposed local services: HTTP on port 80, ADB on port 5555, or SSH on port 22. The data does not indicate that internet-wide exposure is required.
What impact could access to the unauthenticated HTTP API have?
The HTTP REST API can control motors, retrieve telemetry, GPS and IMEI data, disclose the WiFi password in plaintext through /api/v1/wifi/status, join arbitrary WiFi networks, and export diagnostics.
How severe is ADB exposure on affected devices?
ADB on port 5555 provides access to a root shell, giving an attacker with access to that interface full privileged command execution on the device.
Which firmware version is identified as affected?
The affected firmware is identified as FrodoBots EarthRover Mini+ version 6.2.4_6.2.5_0.614.0.