by Kastro
Paper/Archive/CVE-2026-121688

CVE-2026-121688

FrodoBots FrodoBots EarthRover Mini+ firmware — CVE-2026-121688

EPSS 0.1%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 1.6.016 × 200.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

Affected

ProductAffectedFixed inSource
FrodoBots EarthRover Mini+ firmware6.2.4_6.2.5_0.614.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffrodobots.airefgithub.com/frodobots-orgrefkb.cert.org/vuls/id/188754