EARTHROVER MINI+ FIRMWARE · CVE-2026-121685 · Infrastructure
NO FIX YET
The EarthRover Mini+ robot firmware (6.2.4_6.2.5_0.614.0) embeds several shared credentials, including AWS IAM keys, AWS IoT MQTT credentials, an Agora token service login and a Slack webhook. Anyone who downloads the public firmware image can extract them with static analysis and use them against the fleet's cloud services.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any team running or relying on EarthRover Mini+ robots on this firmware is exposed, because the credentials are the same across the fleet and are readable from the public firmware file. The sources do not say whether the vendor has rotated them or released a fixed firmware. Teams that do not use these robots can skip it.
Not affected if different-firmware-version
Who cares aws-iot, earthrover-mini-plus, firmware, frodobots, iot
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.