CVE-2026-121688: FrodoBots EarthRover Mini+ firmware vulnerability
FrodoBots EarthRover Mini+ firmware (version 6.2.46.2.50.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs the ability to interfere with the device's HTTP firmware retrieval, such as by acting as a network adversary on the path to the update source. Because both the firmware and its MD5 hash are delivered in the same unprotected response, the attacker can replace both with values of their choosing.
Is a cryptographic signature check available to prevent a substituted firmware image?
No. The update mechanism does not implement code signing, so it has no authenticated cryptographic verification of the STM32 motor-controller firmware publisher.
How can I tell whether a device is exposed?
Devices running FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 are affected according to the available information. Exposure depends on the device using the described HTTP-based STM32 firmware update mechanism.