CVE-2026-121685

Full vulnerability record from the local CVENow database.

Description

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-09 17:17:16.680000

Last modified

2026-11-09 17:17:16.680000

View original CVE JSON

{
  "id": "CVE-2026-121685",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T17:17:16.680",
  "lastModified": "2026-11-09T17:17:16.680",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FrodoBots",
          "product": "FrodoBots EarthRover Mini+ firmware",
          "versions": [
            {
              "version": "6.2.4_6.2.5_0.614.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://github.com/frodobots-org",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.cert.org/vuls/id/188754",
      "source": "[email protected]"
    },
    {
      "url": "https://www.frodobots.ai/",
      "source": "[email protected]"
    }
  ]
}