CVE-2026-121685 PUBLISHED

CVE-2026-121685

Assigner: certcc
Reserved: 03.11.2026 Published: 09.11.2026 Updated: 09.11.2026

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.

Product Status

Vendor FrodoBots
Product FrodoBots EarthRover Mini+ firmware
Versions
  • Version 6.2.4_6.2.5_0.614.0 is affected

References

Problem Types

  • CWE-798 Use of Hard-coded Credentials