{"id":"CVE-2026-121687","kind":"vulnerability","aliases":["CVE-2026-121687"],"related":[],"title":"FrodoBots EarthRover Mini+ robot: unauthenticated local APIs expose control and Wi-Fi password","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)","summary":"The EarthRover Mini+ firmware exposes an HTTP REST API on port 80, ADB on port 5555 and SSH on port 22 without authentication. An attacker on the same network can control the robot's motors, read GPS and telemetry, read the plaintext Wi-Fi password, join arbitrary networks and reach a root shell over ADB.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EarthRover Mini+ firmware","fixed":[],"affected":"6.2.4_6.2.5_0.614.0 (only version named by NVD; full range unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["earthrover-mini-plus","frodobots","iot","other","robotics"],"not_affected_if":["isolated-network","no-robot-deployed"],"how_to_check":"- Check whether the robot's firmware is `6.2.4_6.2.5_0.614.0` or the version the vendor lists as affected.\n- Check whether ports 80, 5555 or 22 on the robot answer from the network.\n- Check whether `GET /api/v1/wifi/status` returns data without credentials.","fix":null,"status":"open","published_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:29:04+00:00","updated_at":"2026-11-09T17:30:18+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T17:29:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FrodoBots EarthRover Mini+ robot: unauthenticated local APIs expose control and Wi-Fi password","impact":"high","summary":"The EarthRover Mini+ firmware exposes an HTTP REST API on port 80, ADB on port 5555 and SSH on port 22 without authentication. An attacker on the same network can control the robot's motors, read GPS and telemetry, read the plaintext Wi-Fi password, join arbitrary networks and reach a root shell over ADB.","audience":"businesses","category":"other","nicknames":[],"who_cares":["frodobots","earthrover-mini-plus","iot","robotics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes root shell and reads Wi-Fi password","analyst_note":"Confirm the fixed firmware version and whether the vendor has issued a patch; the sources give no fix.","how_to_check":"- Check whether the robot's firmware is `6.2.4_6.2.5_0.614.0` or the version the vendor lists as affected.\n- Check whether ports 80, 5555 or 22 on the robot answer from the network.\n- Check whether `GET /api/v1/wifi/status` returns data without credentials.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["isolated-network","no-robot-deployed"],"who_is_affected":"Teams that run FrodoBots EarthRover Mini+ robots on a network. Any device on the same local network can reach the exposed interfaces, so a robot on a shared or public network is the main concern. unknown whether an internet-facing path exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4635,"output_tokens":614,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether the vendor has issued a patch; the sources give no fix.","search":"'-121687':17A,20A '-2026':16A,19A '/api/v1/wifi/status':118C '0.614.0':95C '1':105C '2':125C '22':52B,139C '3':136C '5555':47B,131C '6.2.4':93C '6.2.5':94C '80':43B,110C 'access':132C 'adb':44B,87B,126C 'android':127C 'api':7A,40B,108C 'arbitrari':79B,121C 'attack':56B 'authent':54B,104C 'bridg':129C 'contain':96C 'control':9A,62B,112C 'cve':15A,18A 'debug':128C 'diagnost':123C 'earthrov':2A,25B,33B,89C 'earthrover':21A 'earthrover-mini-plus':24B 'export':124C 'expos':8A,36B,102C 'fi':13A,76B 'firmwar':35B,91C 'firmware':23A 'frodobot':1A,28B,88C 'get':117C 'gps':68B 'http':38B,106C 'interfac':99C 'iot':29B 'join':78B,120C 'join-arbitrary-wifi':119C 'local':6A,98C 'mini':3A,22A,26B,34B,90C 'motor':66B,111C 'network':60B,80B 'password':14A,77B,116C 'plaintext':73B,114C 'plus':27B 'port':42B,46B,51B,109C,130C,138C 'reach':82B 'read':67B,71B 'rest':39B,107C 'robot':4A,31B,64B 'root':84B,134C 'sever':97C 'shell':85B,135C 'ssh':49B,137C 'telemetri':70B 'telemetry/gps/imei':113C 'unauthent':5A 'version':92C 'wi':12A,75B 'wi-fi':11A,74B 'wifi':115C,122C 'without':53B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams that run FrodoBots EarthRover Mini+ robots on a network. Any device on the same local network can reach the exposed interfaces, so a robot on a shared or public network is the main concern. unknown whether an internet-facing path exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["earthroverminifirmware","minifirmware"],"ptokens":["earthrover","firmware","mini"],"labels":["earthroverminiplus","frodobots","high","iot","other","robotics"],"campaign_type":null,"search_a":"'-121687':17A,20A '-2026':16A,19A 'api':7A 'control':9A 'cve':15A,18A 'earthrov':2A 'earthrover':21A 'expos':8A 'fi':13A 'firmware':23A 'frodobot':1A 'local':6A 'mini':3A,22A 'password':14A 'robot':4A 'unauthent':5A 'wi':12A 'wi-fi':11A","search_b":"'22':52B '5555':47B '80':43B 'adb':44B,87B 'api':40B 'arbitrari':79B 'attack':56B 'authent':54B 'control':62B 'earthrov':25B,33B 'earthrover-mini-plus':24B 'expos':36B 'fi':76B 'firmwar':35B 'frodobot':28B 'gps':68B 'http':38B 'iot':29B 'join':78B 'mini':26B,34B 'motor':66B 'network':60B,80B 'password':77B 'plaintext':73B 'plus':27B 'port':42B,46B,51B 'reach':82B 'read':67B,71B 'rest':39B 'robot':31B,64B 'root':84B 'shell':85B 'ssh':49B 'telemetri':70B 'wi':75B 'wi-fi':74B 'without':53B","search_c":"'/api/v1/wifi/status':118C '0.614.0':95C '1':105C '2':125C '22':139C '3':136C '5555':131C '6.2.4':93C '6.2.5':94C '80':110C 'access':132C 'adb':126C 'android':127C 'api':108C 'arbitrari':121C 'authent':104C 'bridg':129C 'contain':96C 'control':112C 'debug':128C 'diagnost':123C 'earthrov':89C 'export':124C 'expos':102C 'firmwar':91C 'frodobot':88C 'get':117C 'http':106C 'interfac':99C 'join':120C 'join-arbitrary-wifi':119C 'local':98C 'mini':90C 'motor':111C 'password':116C 'plaintext':114C 'port':109C,130C,138C 'rest':107C 'root':134C 'sever':97C 'shell':135C 'ssh':137C 'telemetry/gps/imei':113C 'version':92C 'wifi':115C,122C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121687","severity":null,"published_at":"2026-11-09T17:17:16+00:00","modified_at":"2026-11-09T17:17:16+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121687:2308","url":null,"severity":null,"published_at":"2026-11-09T17:30:18+00:00","modified_at":"2026-11-09T17:30:18+00:00","first_seen_at":"2026-11-09T17:30:18+00:00","fetched_at":"2026-11-09T17:30:18+00:00","note":"No vendor/maintainer advisory found: web-cli (Exa) out of credits, NVD page via WebFetch returned no content. Only NVD description known; fix and affected range beyond 6.2.4_6.2.5_0.614.0 unknown. Nothing verified. Revisit when search works: look for FrodoBots advisory/firmware release."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}