CVE-2026-121686
Received Received - Intake

Unauthenticated Remote Code Execution in FrodoBots EarthRover Mini+ Firmware

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: CERT/CC

Description
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121686
EUVD
EUVD-2026-120091

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frodobots earthrover_mini 6.2.4_6.2.5_0.614.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has a critical flaw allowing unauthenticated remote code execution via MQTT. The firmware accepts arbitrary shell commands through AWS IoT MQTT messages and executes them as root. Access requires only shared IoT credentials without per-device authentication, enabling widespread remote code execution across all devices using this firmware.

Detection Guidance

Detecting this vulnerability requires monitoring MQTT traffic for suspicious commands. Check for unauthorized AWS IoT MQTT messages containing shell commands. Inspect firmware logs for unexpected root-level command executions. Use network monitoring tools to capture MQTT packets and analyze payloads for command injection patterns.

Impact Analysis

This vulnerability allows attackers to remotely execute arbitrary commands as root on affected devices. This could lead to complete device compromise, data theft, unauthorized access to connected systems, or turning devices into part of a botnet. Since it affects an IoT device fleet, the impact scales across all devices using the vulnerable firmware version.

Compliance Impact

This vulnerability likely violates multiple compliance requirements including data protection regulations like GDPR and HIPAA. It enables unauthorized access to systems, potential data breaches, and lack of proper authentication controls. Organizations using affected devices would face compliance violations, legal liabilities, and potential fines for inadequate security measures.

Mitigation Strategies

Immediately disable or restrict access to the MQTT interface used by FrodoBots EarthRover Mini+ firmware. Ensure AWS IoT credentials are rotated and per-device authentication is enforced. Update firmware to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...