CERT/CC VU#188754 reports multiple flaws in FrodoBots EarthRover Mini+ firmware

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware, version 6.2.4_6.2.5_0.614.0, may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full device compromise. Exploitation may enable an attacker to control the rover remotely, reach its audio and video streams, or move into the user's network.

CVE-2026-121685 covers hard-coded, fleet-wide credentials embedded in frodobot.bin, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These are reachable through static analysis of the publicly downloadable firmware or from any device, and extraction requires no special privileges. CVE-2026-121686 allows unauthenticated remote command execution: a firmware method executes arbitrary shell commands delivered in AWS IoT MQTT messages, running them as root. Access depends only on those shared IoT credentials across the fleet, with no per-device authentication.

CVE-2026-121687 covers unauthenticated local interfaces: an HTTP REST API on port 80 for motor control and telemetry, including GPS and IMEI data, with endpoints that reveal the plaintext Wi-Fi password, enable Wi-Fi join, and provide diagnostic export; an ADB root shell on port 5555; and SSH on port 22. CVE-2026-121688 concerns the STM32 motor-controller firmware, fetched over unencrypted HTTP and validated only through an MD5 hash supplied in the same response, with no code signing.

CVE-2026-121689 stores the Wi-Fi PSK in plaintext in wpa_supplicant.conf and discloses it through unauthenticated API endpoints and diagnostic exports, while unauthenticated ADB access allows retrieval of /etc/shadow. CVE-2026-121690 reports that all processes run as root without privilege separation, so compromising any single service results in full administrative control of the device.

Exploitation of these vulnerabilities may allow unauthorized access to live camera and microphone feeds, fleet-wide remote root access and full robot control via MQTT, extraction of the user's Wi-Fi credentials with lateral movement onto the local network, persistent compromise through tampered motor-controller firmware, and unauthorized posting to the vendor's Slack channels with potential exposure of backend infrastructure through IAM credential misuse. Given the rover's mobility and sensor suite, exploitation may enable both digital and physical impacts.

The vendor reports CVE-2026-121685 and CVE-2026-121686 as addressed: most embedded credentials were removed, one remains for requesting an Agora session token with backend authorization checks restricting misuse, and arbitrary shell execution was removed in favor of predefined commands such as reboot. CVE-2026-121687 through CVE-2026-121690 are addressed or not remotely exploitable under the current deployment model, as the vendor asserts exploitation requires physical proximity and connection to the device's Wi-Fi access point, which has a configurable password. Users are encouraged to update to the latest firmware.