{"vuid":"VU#188754","idnumber":"188754","name":"FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities","keywords":null,"overview":"### Overview\r\nMultiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network.\r\n\r\n### Description\r\nThe FrodoBots EarthRover Mini+ is a compact, internet‑connected mobile robot used in educational and consumer environments. The device includes a camera, microphone, motor controllers, and multiple onboard services. Multiple vulnerabilities in the EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) can allow remote code execution, unauthorized access to onboard sensors, exposure of sensitive data, and complete device compromise. An attacker could potentially take remote control of the rover, access its audio and video streams, or use it to gain a foothold in its network.\r\n\r\n**CVE-2026-121685**: The firmware contains several sets of hard-coded, fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM (Amazon Web Services Identity and Access Management) access keys,  Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) credentials, and a Slack incoming webhook URL. Agora Token Service is an open source server that generates secure, time‑limited authentication tokens for use with Agora.io’s RTC (Real‑Time Communication) and RTM (Real‑Time Messaging) services. A Slack incoming webhook URL is a unique endpoint that lets external systems send messages into a Slack channel without the need for a full Slack application. These are embedded directly in `frodobot.bin` and are accessible through static analysis of the publicly downloadable firmware or from any device. Extraction requires no special privileges.\r\n\r\n**CVE-2026-121686**: Unauthenticated remote command execution is allowed via Message Queuing Telemetry Transport (MQTT). A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution (RCE) as root across the fleet. The IoT credentials are hard-coded in the firmware as discussed in **CVE-2026-121685**.\r\n\r\n**CVE-2026-121687**: Several local interfaces are exposed without authentication. These services allow full local compromise of device functionality and provide access to sensitive information.\r\n* HTTP REST API on port 80 (motor control, telemetry/GPS/IMEI) contains endpoints that reveal the plaintext Wi‑Fi password, enable Wi‑Fi join functionality, diagnostic export services\r\n* Android Debug Bridge (ADB) root shell on port 5555\r\n* SSH on port 22  \r\n\r\n**CVE-2026-121688**: The firmware contains an insecure STM32 update mechanism. STM32 is a family of 32-bit microcontrollers and is based primarily on Arm Cortex-M processor cores. They are widely used in embedded systems, IoT devices, industrial controls, robotics, automotive electronics, and consumer products. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.\r\n\r\n**CVE-2026-121689**: The firmware exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in `wpa_supplicant.conf` and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the `/etc/shadow` file.\r\n\r\n**CVE-2026-121690**: The firmware executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.\r\n\r\n### Impact\r\nExploitation of these vulnerabilities may allow:\r\n* Unauthorized access to live camera and microphone feeds.\r\n* Fleet‑wide remote root access and full robot control via MQTT.\r\n* Extraction of the user’s Wi‑Fi credentials and lateral movement onto the local network.\r\n* Persistent compromise through tampered motor‑controller firmware.\r\n* Unauthorized posting to the vendor’s Slack channels and potential exposure of backend infrastructure via IAM credential misuse.\r\n* Given the rover’s mobility and sensor suite, exploitation may enable both digital and physical impacts.\r\n\r\n### Solution\r\nAs of this writing, the vendor has provided the following remediation status:\r\n\r\nCVE-2026-121685 (Hard-coded credentials): Addressed\r\n\r\nMost embedded credentials have been removed. One credential remains for requesting an Agora session token; backend authorization checks restrict misuse. Remaining credentials are limited to session‑bound operations.\r\n\r\nCVE-2026-121686 (Remote command execution): Addressed\r\n\r\nArbitrary shell command execution has been removed. The device now supports only a small set of predefined management commands (e.g., reboot).\r\n\r\nCVE-2026-121687 -- CVE-2026-121690. (Local interfaces and privilege model): Addressed or not remotely exploitable under current deployment model.\r\n\r\nLocal interfaces require connection to the device’s Wi‑Fi access point, which has a configurable password. The vendor asserts that an attacker must be physically near the device and connected to its Wi‑Fi network to exploit these interfaces. The firmware update process is manual and conducted through the local Wi‑Fi network.\r\n\r\nThe vendor validated changes via static analysis and internal implementation review, and considers the findings fixed, mitigated, or not applicable in the current deployment model.\r\n\r\nUsers are encouraged to update to the latest version of the FrodoBots EarthRover Mini+ firmware.\r\n\r\n### Acknowledgements\r\nThank you to Justin Davis for reporting these vulnerabilities. This document was written by Bob Kemerer.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["https://www.frodobots.ai/","https://github.com/frodobots-org"],"cveids":["CVE-2026-121689","CVE-2026-121686","CVE-2026-121685","CVE-2026-121690","CVE-2026-121688","CVE-2026-121687"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-11-09T16:21:18.099373Z","publicdate":"2026-11-09T16:21:17.909018Z","datefirstpublished":"2026-11-09T16:21:18.111696Z","dateupdated":"2026-11-09T16:21:17.909014Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":272}