Six security flaws in the FrodoBots EarthRover Mini+ could let an attacker take remote control of the small internet-connected robot, watch its camera feed and listen through its microphone, or use it as a foothold into the owner's home network. CERT/CC disclosed the vulnerabilities on 9 November 2026 as note VU#188754.

The EarthRover Mini+ is a compact mobile robot used in educational and consumer settings. It carries a camera, a microphone and motor controllers, and connects to the internet so owners can drive it remotely. According to CERT/CC, exploitation of the flaws "may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices."

Hard-coded keys gave one key to the whole fleet

The most serious flaw, CVE-2026-121685, is a set of hard-coded, fleet-wide credentials embedded in the robot's firmware, version 6.2.4_6.2.5_0.614.0. They include AWS access keys, AWS IoT MQTT credentials, a Slack webhook address and credentials for an Agora token service. Anyone could extract them from the publicly downloadable firmware file, with no special privileges needed.

Those credentials then unlock the second flaw, CVE-2026-121686: an MQTT command channel that accepts arbitrary shell commands and runs them as root, with no check that the command came from the robot's own owner. Together, the two flaws gave one key to the whole fleet, so a single leaked secret could in principle reach every EarthRover Mini+.

Local flaws expose Wi-Fi passwords and root shells

Four further flaws need access to the robot's own network. CVE-2026-121687 covers local interfaces exposed without login: a web API on port 80, an Android Debug Bridge root shell on port 5555 and SSH on port 22. The web API can reveal the owner's Wi-Fi password in plaintext.

CVE-2026-121688 is an insecure update mechanism for the motor controller: firmware is fetched over unencrypted HTTP and checked only with an MD5 hash sent in the same unprotected response, with no code signing, so malicious firmware could be substituted. CVE-2026-121689 is the Wi-Fi password stored in plaintext, retrievable through the unauthenticated API or through ADB access to the system's password file. CVE-2026-121690 is the privilege model itself: every process on the device runs as root, so compromising any single service gives full control.

What FrodoBots has done and what owners should do

FrodoBots has revoked the hard-coded cloud credentials at their source and limited remote commands so one device's credentials can no longer affect the wider fleet. The remaining fixes will arrive in a firmware update that is in development and internal testing, and will roll out to devices gradually.

Until then, the company advises owners to run the rover only on a trusted, private network, avoid shared or untrusted Wi-Fi, and set a strong password on the rover's own Wi-Fi access point. Once the firmware update ships, owners should install it promptly.

No exploitation in the wild has been confirmed. Researcher Justin Davis, who reported the flaws, tested only a device of their own, and FrodoBots says it has no indication that any vendor infrastructure or third-party device was accessed.

Read the CERT/CC vulnerability note VU#188754 and the SecurityOnline report on the EarthRover flaws for the full detail.