CVE-2026-121688
Received Received - Intake

Insecure Firmware Update in FrodoBots EarthRover Mini+

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: CERT/CC

Description
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121688
EUVD
EUVD-2026-120093

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
frodobots earthrover_mini 6.2.4
stmicroelectronics stm32 *
frodobots earthrover_mini 6.2.4_6.2.5_0.614.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has an insecure firmware update system. The motor-controller firmware is downloaded over unencrypted HTTP without any protection. Integrity is only checked using a weak MD5 hash provided in the same unprotected download, and there is no code-signing to verify authenticity. This allows attackers to replace the firmware with malicious versions.

Detection Guidance

Check network traffic for unencrypted HTTP requests to firmware update servers. Inspect firmware update responses for MD5 hashes without code-signing validation. Monitor for unauthorized STM32 firmware changes or unexpected motor controller behavior.

Impact Analysis

This vulnerability could allow attackers to intercept and modify firmware updates, replacing the legitimate motor-controller firmware with malicious code. This might lead to unauthorized control of the device, potential physical damage, or compromise of connected systems. Users could face safety risks, operational disruptions, or data breaches depending on the device's use case.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure transmission and integrity verification of firmware updates, such as those in GDPR (data protection) or HIPAA (healthcare data security). Failure to implement secure update mechanisms may result in non-compliance, legal penalties, or loss of certification for devices handling sensitive data.

Mitigation Strategies

Disable HTTP-based firmware updates immediately. Switch to a secure, encrypted channel for firmware distribution. Implement code-signing validation for all firmware updates. Contact FrodoBots for a patched firmware version that addresses this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...