---
id: "CVE-2026-121686"
page: "https://infrastack.ai/live/CVE-2026-121686"
kind: "vulnerability"
aliases: ["CVE-2026-121686"]
title: "FrodoBots EarthRover Mini+ firmware lets remote attackers run root commands via MQTT"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EarthRover Mini+ firmware", "fixed": [], "affected": "6.2.4_6.2.5_0.614.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aws-iot", "earthrover-mini-plus", "frodobots", "infrastructure", "mqtt", "robotics"]
not_affected_if: ["no-aws-iot-connection"]
published_at: "2026-11-09T17:17:16+00:00"
first_seen_at: "2026-11-09T17:27:38+00:00"
updated_at: "2026-11-09T17:30:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121686", "first_seen_at": "2026-11-09T17:27:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T17:30:20+00:00"}]
exploit_sources: []
---

# FrodoBots EarthRover Mini+ firmware lets remote attackers run root commands via MQTT

Link for people: https://infrastack.ai/live/CVE-2026-121686 (this .md is for agents)

The FrodoBots EarthRover Mini+ robot firmware has a method that accepts arbitrary shell commands over AWS IoT MQTT messages and runs them as root. Access is gated only by shared IoT credentials with no per-device authentication, so an attacker who obtains those credentials can execute code as root across the fleet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EarthRover Mini+ firmware affected 6.2.4_6.2.5_0.614.0 fixed no fixed version listed

## How to check

- Check the installed firmware version on each EarthRover Mini+ against `6.2.4_6.2.5_0.614.0`

## Timeline

- 2026-11-09T17:27:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121686
- 2026-11-09T17:30:20+00:00 analyst — No vendor advisory or fix found: web-cli search is out of Exa credits and the NVD page fetch returned no content. Only the NVD description is known. Fix version is unknown. Nothing verified. Needs a revisit to look for a FrodoBots advisory or a researcher writeup. Sibling CVEs 121687, 121688 and 121689 cover the same product.

## From the sources

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_