by Kastro
Paper/Archive/CVE-2026-121685

CVE-2026-121685

FrodoBots FrodoBots EarthRover Mini+ firmware — CVE-2026-121685

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 11.8.118 × 202.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.

Affected

ProductAffectedFixed inSource
FrodoBots EarthRover Mini+ firmware6.2.4_6.2.5_0.614.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffrodobots.airefgithub.com/frodobots-orgrefkb.cert.org/vuls/id/188754