{"id":"CVE-2026-121686","kind":"vulnerability","aliases":["CVE-2026-121686"],"related":[],"title":"FrodoBots EarthRover Mini+ firmware lets remote attackers run root commands via MQTT","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.","summary":"The FrodoBots EarthRover Mini+ robot firmware has a method that accepts arbitrary shell commands over AWS IoT MQTT messages and runs them as root. Access is gated only by shared IoT credentials with no per-device authentication, so an attacker who obtains those credentials can execute code as root across the fleet.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EarthRover Mini+ firmware","fixed":[],"affected":"6.2.4_6.2.5_0.614.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["aws-iot","earthrover-mini-plus","frodobots","infrastructure","mqtt","robotics"],"not_affected_if":["no-aws-iot-connection"],"how_to_check":"- Check the installed firmware version on each EarthRover Mini+ against `6.2.4_6.2.5_0.614.0`","fix":null,"status":"open","published_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:29:07+00:00","updated_at":"2026-11-09T17:30:20+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-09T17:29:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FrodoBots EarthRover Mini+ firmware lets remote attackers run root commands via MQTT","impact":"high","summary":"The FrodoBots EarthRover Mini+ robot firmware has a method that accepts arbitrary shell commands over AWS IoT MQTT messages and runs them as root. Access is gated only by shared IoT credentials with no per-device authentication, so an attacker who obtains those credentials can execute code as root across the fleet.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["frodobots","earthrover-mini-plus","aws-iot","mqtt","robotics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary root commands on robots across the fleet.","analyst_note":"Confirm the fix version and any vendor advisory for EarthRover Mini+ firmware; the NVD entry gives no fix or severity score.","how_to_check":"- Check the installed firmware version on each EarthRover Mini+ against `6.2.4_6.2.5_0.614.0`\n- unknown for other checks: the sources do not say which settings or files to inspect","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-aws-iot-connection"],"who_is_affected":"Teams that run FrodoBots EarthRover Mini+ robots on firmware version 6.2.4_6.2.5_0.614.0 and connect them to AWS IoT over MQTT are exposed. Because the shared IoT credentials are the only gate, any device sharing those credentials is reachable. The sources do not say whether robots that are not connected to AWS IoT are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000784,"input_tokens":4651,"output_tokens":637,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fix version and any vendor advisory for EarthRover Mini+ firmware; the NVD entry gives no fix or severity score.","search":"'-121686':15A,18A '-2026':14A,17A '0.614.0':93C '6.2.4':91C '6.2.5':92C 'accept':43B,106C 'access':57B,131C 'across':83B,153C 'amazon':112C 'arbitrari':44B,107C 'attack':7A,73B 'authent':70B,146C 'aw':23B,48B,122C 'aws-iot':22B 'code':80B,99C,149C 'command':10A,46B,109C 'credenti':64B,77B,141C 'cve':13A,16A 'deliv':110C 'devic':69B,145C 'earthrov':2A,26B,35B,87C 'earthrover':19A 'earthrover-mini-plus':25B 'enabl':147C 'execut':79B,100C,127C,150C 'firmwar':4A,38B,89C,104C 'firmware':21A 'fleet':85B,155C 'frodobot':1A,29B,34B,86C 'gate':59B,133C 'infrastructur':30B 'internet':115C,137C 'iot':24B,49B,63B,123C,140C 'let':5A 'messag':51B,118C,125C 'method':41B,105C 'mini':3A,20A,27B,36B,88C 'mqtt':12A,31B,50B,102C,124C 'obtain':75B 'per':68B,144C 'per-devic':67B 'plus':28B 'queu':119C 'remot':6A,98C,148C 'robot':32B,37B 'root':9A,56B,82B,130C,152C 'run':8A,53B 'servic':114C 'share':62B,136C 'shell':45B,108C 'telemetri':120C 'thing':117C,139C 'transport':121C 'unauthent':97C 'version':90C 'via':11A,101C,111C 'vulner':95C 'web':113C","nicknames":[],"mitigations":[],"who_affected":"Teams that run FrodoBots EarthRover Mini+ robots on firmware version 6.2.4_6.2.5_0.614.0 and connect them to AWS IoT over MQTT are exposed. Because the shared IoT credentials are the only gate, any device sharing those credentials is reachable. The sources do not say whether robots that are not connected to AWS IoT are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["earthroverminifirmware","minifirmware"],"ptokens":["earthrover","firmware","mini"],"labels":["awsiot","critical","earthroverminiplus","frodobots","infrastructure","mqtt","robotics"],"campaign_type":null,"search_a":"'-121686':15A,18A '-2026':14A,17A 'attack':7A 'command':10A 'cve':13A,16A 'earthrov':2A 'earthrover':19A 'firmwar':4A 'firmware':21A 'frodobot':1A 'let':5A 'mini':3A,20A 'mqtt':12A 'remot':6A 'root':9A 'run':8A 'via':11A","search_b":"'accept':43B 'access':57B 'across':83B 'arbitrari':44B 'attack':73B 'authent':70B 'aw':23B,48B 'aws-iot':22B 'code':80B 'command':46B 'credenti':64B,77B 'devic':69B 'earthrov':26B,35B 'earthrover-mini-plus':25B 'execut':79B 'firmwar':38B 'fleet':85B 'frodobot':29B,34B 'gate':59B 'infrastructur':30B 'iot':24B,49B,63B 'messag':51B 'method':41B 'mini':27B,36B 'mqtt':31B,50B 'obtain':75B 'per':68B 'per-devic':67B 'plus':28B 'robot':32B,37B 'root':56B,82B 'run':53B 'share':62B 'shell':45B","search_c":"'0.614.0':93C '6.2.4':91C '6.2.5':92C 'accept':106C 'access':131C 'across':153C 'amazon':112C 'arbitrari':107C 'authent':146C 'aw':122C 'code':99C,149C 'command':109C 'credenti':141C 'deliv':110C 'devic':145C 'earthrov':87C 'enabl':147C 'execut':100C,127C,150C 'firmwar':89C,104C 'fleet':155C 'frodobot':86C 'gate':133C 'internet':115C,137C 'iot':123C,140C 'messag':118C,125C 'method':105C 'mini':88C 'mqtt':102C,124C 'per':144C 'queu':119C 'remot':98C,148C 'root':130C,152C 'servic':114C 'share':136C 'shell':108C 'telemetri':120C 'thing':117C,139C 'transport':121C 'unauthent':97C 'version':90C 'via':101C,111C 'vulner':95C 'web':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121686","severity":null,"published_at":"2026-11-09T17:17:16+00:00","modified_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121686:2305","url":null,"severity":null,"published_at":"2026-11-09T17:30:20+00:00","modified_at":"2026-11-09T17:30:20+00:00","first_seen_at":"2026-11-09T17:30:20+00:00","fetched_at":"2026-11-09T17:30:20+00:00","note":"No vendor advisory or fix found: web-cli search is out of Exa credits and the NVD page fetch returned no content. Only the NVD description is known. Fix version is unknown. Nothing verified. Needs a revisit to look for a FrodoBots advisory or a researcher writeup. Sibling CVEs 121687, 121688 and 121689 cover the same product."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}