{"id":"CVE-2026-121685","kind":"vulnerability","aliases":["CVE-2026-121685"],"related":[],"title":"FrodoBots EarthRover Mini+ firmware ships hard-coded fleet-wide cloud credentials","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.","summary":"The EarthRover Mini+ robot firmware (6.2.4_6.2.5_0.614.0) embeds several shared credentials, including AWS IAM keys, AWS IoT MQTT credentials, an Agora token service login and a Slack webhook. Anyone who downloads the public firmware image can extract them with static analysis and use them against the fleet's cloud services.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EarthRover Mini+ firmware","fixed":[],"affected":"6.2.4_6.2.5_0.614.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aws-iot","earthrover-mini-plus","firmware","frodobots","infrastructure","iot"],"not_affected_if":["different-firmware-version"],"how_to_check":"- Check whether the device runs firmware 6.2.4_6.2.5_0.614.0 (the only version the NVD record names).\n- Extract frodobot.bin from the public firmware image and search it for AWS keys, MQTT credentials, the Agora token-service login and the Slack webhook URL.\n- If you operate the cloud accounts, check whether the AWS IAM keys, IoT MQTT credentials and Slack webhook still work; rotate any that do.","fix":null,"status":"open","published_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:29:09+00:00","updated_at":"2026-11-09T17:31:34+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-09T17:29:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FrodoBots EarthRover Mini+ firmware ships hard-coded fleet-wide cloud credentials","impact":"high","summary":"The EarthRover Mini+ robot firmware (6.2.4_6.2.5_0.614.0) embeds several shared credentials, including AWS IAM keys, AWS IoT MQTT credentials, an Agora token service login and a Slack webhook. Anyone who downloads the public firmware image can extract them with static analysis and use them against the fleet's cloud services.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["frodobots","earthrover-mini-plus","iot","aws-iot","firmware"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads fleet-wide cloud keys and controls devices or accounts","analyst_note":"Find the vendor advisory or NVD detail for CVE-2026-121685 to confirm whether credentials were rotated and a fixed firmware exists.","how_to_check":"- Check whether the device runs firmware version `6.2.4_6.2.5_0.614.0`.\n- Extract `frodobot.bin` from the firmware image and search it for embedded keys and URLs, as the description says these are stored in plain text.\n- Check whether the AWS IAM keys, MQTT credentials and Slack webhook are still active in the cloud accounts.","plain_action":"","product_name":"EarthRover Mini+ firmware","needs_analyst":true,"not_affected_if":["different-firmware-version"],"who_is_affected":"Any team running or relying on EarthRover Mini+ robots on this firmware is exposed, because the credentials are the same across the fleet and are readable from the public firmware file. The sources do not say whether the vendor has rotated them or released a fixed firmware. Teams that do not use these robots can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000821,"input_tokens":4643,"output_tokens":713,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory or NVD detail for CVE-2026-121685 to confirm whether credentials were rotated and a fixed firmware exists.","search":"'-121685':16A,19A '-2026':15A,18A '0.614.0':41B,92C '6.2.4':39B,90C '6.2.5':40B,91C 'access':116C,137C 'agora':55B,111C 'analysi':75B,140C 'anyon':63B 'aw':24B,47B,50B,114C,118C 'aws-iot':23B 'basicauth':107C 'cloud':12A,83B 'code':8A,99C 'contain':93C 'credenti':13A,45B,53B,100C,105C,108C,121C,129C 'cve':14A,17A 'direct':132C 'download':65B,144C 'earthrov':2A,27B,35B,86C 'earthrover':20A 'earthrover-mini-plus':26B 'emb':42B 'embed':131C 'extract':71B,146C 'firmwar':4A,30B,38B,68B,88C,145C 'firmware':22A 'fleet':10A,81B,103C 'fleet-wid':9A 'frodobot':1A,31B,85C 'frodobot.bin':134C 'hard':7A,98C 'hard-cod':6A,97C 'iam':48B,115C 'imag':69B 'includ':46B,102C,106C 'incom':125C 'infrastructur':32B 'iot':25B,33B,51B,119C 'key':49B,117C 'login':58B 'mini':3A,21A,28B,36B,87C 'mqtt':52B,120C 'multipl':94C 'plus':29B 'privileg':150C 'public':67B,143C 'requir':147C 'robot':37B 'servic':57B,84B,113C 'set':95C 'sever':43B 'share':44B 'ship':5A 'slack':61B,124C 'special':149C 'static':74B,139C 'token':56B,112C 'url':127C 'use':77B 'version':89C 'webhook':62B,126C 'wide':11A,104C","nicknames":[],"mitigations":[],"who_affected":"Any team running or relying on EarthRover Mini+ robots on this firmware is exposed, because the credentials are the same across the fleet and are readable from the public firmware file. The sources do not say whether the vendor has rotated them or released a fixed firmware. Teams that do not use these robots can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["earthroverminifirmware","minifirmware"],"ptokens":["earthrover","firmware","mini"],"labels":["awsiot","earthroverminiplus","firmware","frodobots","high","infrastructure","iot","vendor"],"campaign_type":null,"search_a":"'-121685':16A,19A '-2026':15A,18A 'cloud':12A 'code':8A 'credenti':13A 'cve':14A,17A 'earthrov':2A 'earthrover':20A 'firmwar':4A 'firmware':22A 'fleet':10A 'fleet-wid':9A 'frodobot':1A 'hard':7A 'hard-cod':6A 'mini':3A,21A 'ship':5A 'wide':11A","search_b":"'0.614.0':41B '6.2.4':39B '6.2.5':40B 'agora':55B 'analysi':75B 'anyon':63B 'aw':24B,47B,50B 'aws-iot':23B 'cloud':83B 'credenti':45B,53B 'download':65B 'earthrov':27B,35B 'earthrover-mini-plus':26B 'emb':42B 'extract':71B 'firmwar':30B,38B,68B 'fleet':81B 'frodobot':31B 'iam':48B 'imag':69B 'includ':46B 'infrastructur':32B 'iot':25B,33B,51B 'key':49B 'login':58B 'mini':28B,36B 'mqtt':52B 'plus':29B 'public':67B 'robot':37B 'servic':57B,84B 'sever':43B 'share':44B 'slack':61B 'static':74B 'token':56B 'use':77B 'webhook':62B","search_c":"'0.614.0':92C '6.2.4':90C '6.2.5':91C 'access':116C,137C 'agora':111C 'analysi':140C 'aw':114C,118C 'basicauth':107C 'code':99C 'contain':93C 'credenti':100C,105C,108C,121C,129C 'direct':132C 'download':144C 'earthrov':86C 'embed':131C 'extract':146C 'firmwar':88C,145C 'fleet':103C 'frodobot':85C 'frodobot.bin':134C 'hard':98C 'hard-cod':97C 'iam':115C 'includ':102C,106C 'incom':125C 'iot':119C 'key':117C 'mini':87C 'mqtt':120C 'multipl':94C 'privileg':150C 'public':143C 'requir':147C 'servic':113C 'set':95C 'slack':124C 'special':149C 'static':139C 'token':112C 'url':127C 'version':89C 'webhook':126C 'wide':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121685","severity":null,"published_at":"2026-11-09T17:17:16+00:00","modified_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121685:2309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121685","severity":null,"published_at":"2026-11-09T17:31:34+00:00","modified_at":"2026-11-09T17:31:34+00:00","first_seen_at":"2026-11-09T17:31:34+00:00","fetched_at":"2026-11-09T17:31:34+00:00","note":"Could not reach a vendor advisory: web-cli out of Exa credits, NVD page via WebFetch returned no content. Only the NVD record (linked as describes) supports this. Fix, credential rotation and fixed firmware are unknown; nothing verified. Needs FrodoBots advisory or researcher writeup. Triage's fix_status 'none' is unsupported by a vendor page; leaving fix unstated.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-121685"]}],"documents":[{"id":108604,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121685","title":"NVD CVE-2026-121685","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}