CVE-2026-121689
Received Received - Intake

FrodoBots EarthRover Mini+ Firmware Credential Exposure

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: CERT/CC

Description
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121689
EUVD
EUVD-2026-120094

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frodobots earthrover_mini to 6.2.4 (inc)
frodobots earthrover_mini to 6.2.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has multiple security flaws that expose sensitive credentials. The Wi-Fi password is stored in plaintext in the wpa_supplicant.conf file and can be accessed through unauthenticated API endpoints and diagnostic exports. Additionally, the device allows unauthenticated ADB access, which can be used to retrieve the /etc/shadow file containing user credentials.

Detection Guidance

Check for plaintext Wi-Fi PSK in wpa_supplicant.conf on the device. Look for unauthenticated API endpoints or diagnostic exports that may expose credentials. Verify if ADB access is enabled without authentication and test if /etc/shadow can be retrieved.

Impact Analysis

This vulnerability allows attackers to extract Wi-Fi passwords and user credentials, potentially leading to unauthorized network access, data breaches, or device compromise. Unauthenticated ADB access could enable full control over the device, including sensitive system files.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy regulations such as GDPR and HIPAA. Exposure of credentials and sensitive data could result in unauthorized access to personal or health information, leading to legal and regulatory penalties.

Mitigation Strategies

Update firmware to a patched version. Disable unauthenticated API endpoints and diagnostic exports. Restrict ADB access with strong authentication. Encrypt or secure sensitive files like wpa_supplicant.conf and /etc/shadow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...