{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/188754#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nMultiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network.\r\n\r\n### Description\r\nThe FrodoBots EarthRover Mini+ is a compact, internet‑connected mobile robot used in educational and consumer environments. The device includes a camera, microphone, motor controllers, and multiple onboard services. Multiple vulnerabilities in the EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) can allow remote code execution, unauthorized access to onboard sensors, exposure of sensitive data, and complete device compromise. An attacker could potentially take remote control of the rover, access its audio and video streams, or use it to gain a foothold in its network.\r\n\r\n**CVE-2026-121685**: The firmware contains several sets of hard-coded, fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM (Amazon Web Services Identity and Access Management) access keys,  Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) credentials, and a Slack incoming webhook URL. Agora Token Service is an open source server that generates secure, time‑limited authentication tokens for use with Agora.io’s RTC (Real‑Time Communication) and RTM (Real‑Time Messaging) services. A Slack incoming webhook URL is a unique endpoint that lets external systems send messages into a Slack channel without the need for a full Slack application. These are embedded directly in `frodobot.bin` and are accessible through static analysis of the publicly downloadable firmware or from any device. Extraction requires no special privileges.\r\n\r\n**CVE-2026-121686**: Unauthenticated remote command execution is allowed via Message Queuing Telemetry Transport (MQTT). A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution (RCE) as root across the fleet. The IoT credentials are hard-coded in the firmware as discussed in **CVE-2026-121685**.\r\n\r\n**CVE-2026-121687**: Several local interfaces are exposed without authentication. These services allow full local compromise of device functionality and provide access to sensitive information.\r\n* HTTP REST API on port 80 (motor control, telemetry/GPS/IMEI) contains endpoints that reveal the plaintext Wi‑Fi password, enable Wi‑Fi join functionality, diagnostic export services\r\n* Android Debug Bridge (ADB) root shell on port 5555\r\n* SSH on port 22  \r\n\r\n**CVE-2026-121688**: The firmware contains an insecure STM32 update mechanism. STM32 is a family of 32-bit microcontrollers and is based primarily on Arm Cortex-M processor cores. They are widely used in embedded systems, IoT devices, industrial controls, robotics, automotive electronics, and consumer products. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.\r\n\r\n**CVE-2026-121689**: The firmware exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in `wpa_supplicant.conf` and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the `/etc/shadow` file.\r\n\r\n**CVE-2026-121690**: The firmware executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.\r\n\r\n### Impact\r\nExploitation of these vulnerabilities may allow:\r\n* Unauthorized access to live camera and microphone feeds.\r\n* Fleet‑wide remote root access and full robot control via MQTT.\r\n* Extraction of the user’s Wi‑Fi credentials and lateral movement onto the local network.\r\n* Persistent compromise through tampered motor‑controller firmware.\r\n* Unauthorized posting to the vendor’s Slack channels and potential exposure of backend infrastructure via IAM credential misuse.\r\n* Given the rover’s mobility and sensor suite, exploitation may enable both digital and physical impacts.\r\n\r\n### Solution\r\nAs of this writing, the vendor has provided the following remediation status:\r\n\r\nCVE-2026-121685 (Hard-coded credentials): Addressed\r\n\r\nMost embedded credentials have been removed. One credential remains for requesting an Agora session token; backend authorization checks restrict misuse. Remaining credentials are limited to session‑bound operations.\r\n\r\nCVE-2026-121686 (Remote command execution): Addressed\r\n\r\nArbitrary shell command execution has been removed. The device now supports only a small set of predefined management commands (e.g., reboot).\r\n\r\nCVE-2026-121687 -- CVE-2026-121690. (Local interfaces and privilege model): Addressed or not remotely exploitable under current deployment model.\r\n\r\nLocal interfaces require connection to the device’s Wi‑Fi access point, which has a configurable password. The vendor asserts that an attacker must be physically near the device and connected to its Wi‑Fi network to exploit these interfaces. The firmware update process is manual and conducted through the local Wi‑Fi network.\r\n\r\nThe vendor validated changes via static analysis and internal implementation review, and considers the findings fixed, mitigated, or not applicable in the current deployment model.\r\n\r\nUsers are encouraged to update to the latest version of the FrodoBots EarthRover Mini+ firmware.\r\n\r\n### Acknowledgements\r\nThank you to Justin Davis for reporting these vulnerabilities. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"We have already remediated the highest-impact issues that can be addressed without a device update. Hardcoded cloud credentials identified in the firmware have been revoked at their source and no longer grant access, and remote command authorization has been scoped to individual devices so that a single device's credentials can no longer affect the wider fleet.\r\n\r\nThe remaining items: removal of the now-invalidated credential strings, hardening and access control for the device's local interfaces, and improvements to the firmware update mechanism - are addressed in a firmware update that is in development and internal testing, and that will be rolled out to devices progressively.\r\n\r\nIn the interim, we recommend that owners operate their device only on a trusted, private network and avoid connecting it to shared or untrusted WiFi. The researcher's analysis was conducted on their own device, and we have no indication that any vendor infrastructure or third-party device was accessed.\r\n\r\nWe are committed to resolving these issues and will provide updates as the firmware rollout progresses.","title":"Vendor statment from FrodoBots"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/188754"},{"url":"https://www.frodobots.ai/","summary":"https://www.frodobots.ai/"},{"url":"https://github.com/frodobots-org","summary":"https://github.com/frodobots-org"}],"title":"FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities","tracking":{"current_release_date":"2026-11-09T16:21:17+00:00","generator":{"engine":{"name":"VINCE","version":"4.0.2"}},"id":"VU#188754","initial_release_date":"2026-11-09 16:21:17.909018+00:00","revision_history":[{"date":"2026-11-09T16:21:17+00:00","number":"1.20261109162117.1","summary":"Released on 2026-11-09T16:21:17+00:00"}],"status":"final","version":"1.20261109162117.1"}},"vulnerabilities":[{"title":"FrodoBots EarthRover Mini+ firmware (version 6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)"}],"cve":"CVE-2026-121687","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ff80da4-dc6d-11f1-9472-12fffde0a0b9"]}},{"title":"FrodoBots EarthRover Mini+ firmware (version 6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code."}],"cve":"CVE-2026-121688","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ff90434-dc6d-11f1-9472-12fffde0a0b9"]}},{"title":"FrodoBots EarthRover Mini+ firmware (version 6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device."}],"cve":"CVE-2026-121690","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ff964ec-dc6d-11f1-9472-12fffde0a0b9"]}},{"title":"FrodoBots EarthRover Mini+ firmware (version 6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges."}],"cve":"CVE-2026-121685","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ff9bbb8-dc6d-11f1-9472-12fffde0a0b9"]}},{"title":"FrodoBots EarthRover Mini+ firmware (version 6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet."}],"cve":"CVE-2026-121686","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ffa1194-dc6d-11f1-9472-12fffde0a0b9"]}},{"title":"FrodoBots EarthRover Mini+ firmware (v6.","notes":[{"category":"summary","text":"FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file."}],"cve":"CVE-2026-121689","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#188754"}],"product_status":{"known_affected":["CSAFPID-4ffa6a72-dc6d-11f1-9472-12fffde0a0b9"]}}],"product_tree":{"branches":[{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ff80da4-dc6d-11f1-9472-12fffde0a0b9"}},{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ff90434-dc6d-11f1-9472-12fffde0a0b9"}},{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ff964ec-dc6d-11f1-9472-12fffde0a0b9"}},{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ff9bbb8-dc6d-11f1-9472-12fffde0a0b9"}},{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ffa1194-dc6d-11f1-9472-12fffde0a0b9"}},{"category":"vendor","name":"FrodoBots","product":{"name":"FrodoBots Products","product_id":"CSAFPID-4ffa6a72-dc6d-11f1-9472-12fffde0a0b9"}}]}}