FrodoBots EarthRover Vulnerabilities Allow Remote Root Takeover of Robot Fleet

TL;DR

CERT/CC disclosed six FrodoBots EarthRover vulnerabilities on November 9, 2026, in firmware version 6.2.4_6.2.5_0.614.0 of the EarthRover Mini+. The small internet-connected robot carries a camera, microphone and motors. According to CERT/CC, the flaws “may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices.”

Hard-coded cloud keys and an MQTT command channel let an attacker run root commands on every EarthRover Mini+ in the fleet. FrodoBots has revoked the leaked keys and scoped remote commands to single devices. A firmware update with the remaining fixes is still in testing.

Notable CVEs

Why It Matters

This is a robot that moves, sees and listens. As CERT/CC notes, “exploitation may enable both digital and physical impacts.” An attacker could drive the rover, watch its live video or steal the owner’s Wi-Fi password to reach the home network.

So far, nothing suggests real-world abuse. FrodoBots says researcher Justin Davis tested only a device of their own and “we have no indication that any vendor infrastructure or third-party device was accessed.” No public exploit has been reported either.

How the Attack Works

Remote fleet-wide flaws

The firmware shipped with fleet-wide secrets, including AWS keys, AWS IoT MQTT credentials and a Slack webhook (CVE-2026-121685). Anyone could pull them from the public firmware file. Those MQTT credentials then unlock a command channel that “executes them as root” with no per-device check (CVE-2026-121686). Put together, these two remote code execution bugs gave one key to the whole fleet.

Local flaws

Other bugs require network access to the rover. Its web API, ADB root shell and SSH all run without proper login (CVE-2026-121687). In addition, the motor-controller update travels over plain HTTP with only an MD5 check (CVE-2026-121688). The device also stores the Wi-Fi password in plaintext (CVE-2026-121689). Finally, every process runs as root (CVE-2026-121690).

Affected Versions

• FrodoBots EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0

Patch and Mitigation

FrodoBots says it has revoked the hard-coded cloud credentials at their source. It also limited remote commands so one device’s keys no longer affect the wider fleet. The other fixes will arrive in a firmware update that is “in development and internal testing.” It will roll out to devices gradually.

Until then, the vendor advises owners to run the rover “only on a trusted, private network.” Also set a strong password on the rover’s own Wi-Fi access point. Once it ships, install the latest firmware to close the remaining FrodoBots EarthRover vulnerabilities.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.