# FrodoBots EarthRover Mini+ had fleet-wide root RCE

Published: 2026-11-09 · Severity: routine · Sectors: Education
Canonical: https://vorant.io/reports/3f7748d4-0356-5512-b004-8aa811292113/frodobots-earthrover-mini-had-fleet-wide-root-rce
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT/CC details six firmware flaws in FrodoBots EarthRover Mini+ robots enabling fleet-wide root RCE via hard-coded MQTT credentials; vendor has patched most issues.

Source: kb.cert.org — https://kb.cert.org/vuls/id/188754

## What to check

- Applies to: The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC published Vulnerability Note VU#188754 describing six vulnerabilities in the FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0), a compact internet-connected robot with camera, microphone, and motor controllers used in educational and consumer settings. The most severe issues (CVE-2026-121685 and CVE-2026-121686) involved hard-coded, fleet-wide credentials (Agora token service, AWS IAM, AWS IoT MQTT, and a Slack webhook) embedded in the firmware binary, combined with an MQTT handler that executed arbitrary shell commands as root with no per-device authentication — together allowing unauthenticated remote code execution as root across the entire device fleet. Additional findings (CVE-2026-121687 through CVE-2026-121690) covered unauthenticated local services (HTTP REST API on port 80, ADB root shell on port 5555, SSH on port 22) exposing Wi-Fi credentials and shadow files, an insecure unsigned/unencrypted STM32 motor-controller firmware update mechanism integrity-checked only by an MD5 hash delivered alongside it, and a lack of privilege separation with all processes running as root.

Exploitation could allow an attacker to take live camera/microphone feeds, seize fleet-wide remote root control via MQTT, extract Wi-Fi credentials for lateral network movement, persistently tamper with motor-controller firmware, and misuse exposed Slack/IAM credentials against vendor backend infrastructure. Given the device's mobility and sensors, impacts could extend from digital compromise to physical safety and privacy concerns.

The vendor has remediated the fleet-wide credential exposure and removed the arbitrary MQTT command execution capability, replacing it with a restricted set of predefined management commands. The remaining local-interface and privilege-separation issues (CVE-2026-121687–121690) are asserted by the vendor to require physical proximity and Wi-Fi access-point connection, and are considered mitigated under the current deployment model, though underlying architectural weaknesses (root-run services, unsigned firmware updates) remain. No in-the-wild exploitation is reported; this is a coordinated-disclosure advisory with no confirmed attacker activity. Defenders operating these devices should update to the latest firmware and ensure Wi-Fi access-point passwords are strong and not shared.

## Mentioned in this report

- Vulnerabilities: CVE-2026-121685, CVE-2026-121686, CVE-2026-121687, CVE-2026-121688, CVE-2026-121689, CVE-2026-121690

Source reporting: https://kb.cert.org/vuls/id/188754

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3f7748d4-0356-5512-b004-8aa811292113/frodobots-earthrover-mini-had-fleet-wide-root-rce.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup