EARTHROVER MINI+ FIRMWARE · CVE-2026-121687 · Other
NO FIX YET
The EarthRover Mini+ firmware exposes an HTTP REST API on port 80, ADB on port 5555 and SSH on port 22 without authentication. An attacker on the same network can control the robot's motors, read GPS and telemetry, read the plaintext Wi-Fi password, join arbitrary networks and reach a root shell over ADB.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run FrodoBots EarthRover Mini+ robots on a network. Any device on the same local network can reach the exposed interfaces, so a robot on a shared or public network is the main concern. unknown whether an internet-facing path exists.
Not affected if isolated-network, no-robot-deployed
Who cares earthrover-mini-plus, frodobots, iot, robotics
6.2.4_6.2.5_0.614.0 or the version the vendor lists as affected.GET /api/v1/wifi/status returns data without credentials.Unknown from the sources.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.