---
id: "CVE-2026-121687"
page: "https://infrastack.ai/live/CVE-2026-121687"
kind: "vulnerability"
aliases: ["CVE-2026-121687"]
title: "FrodoBots EarthRover Mini+ robot: unauthenticated local APIs expose control and Wi-Fi password"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "EarthRover Mini+ firmware", "fixed": [], "affected": "6.2.4_6.2.5_0.614.0 (only version named by NVD; full range unknown)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["earthrover-mini-plus", "frodobots", "iot", "other", "robotics"]
not_affected_if: ["isolated-network", "no-robot-deployed"]
published_at: "2026-11-09T17:17:16+00:00"
first_seen_at: "2026-11-09T17:27:38+00:00"
updated_at: "2026-11-09T17:30:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121687", "first_seen_at": "2026-11-09T17:27:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T17:30:18+00:00"}]
exploit_sources: []
---

# FrodoBots EarthRover Mini+ robot: unauthenticated local APIs expose control and Wi-Fi password

Link for people: https://infrastack.ai/live/CVE-2026-121687 (this .md is for agents)

The EarthRover Mini+ firmware exposes an HTTP REST API on port 80, ADB on port 5555 and SSH on port 22 without authentication. An attacker on the same network can control the robot's motors, read GPS and telemetry, read the plaintext Wi-Fi password, join arbitrary networks and reach a root shell over ADB.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EarthRover Mini+ firmware affected 6.2.4_6.2.5_0.614.0 (only version named by NVD; full range unknown) fixed no fixed version listed

## How to check

- Check whether the robot's firmware is `6.2.4_6.2.5_0.614.0` or the version the vendor lists as affected.
- Check whether ports 80, 5555 or 22 on the robot answer from the network.
- Check whether `GET /api/v1/wifi/status` returns data without credentials.

## Timeline

- 2026-11-09T17:27:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121687
- 2026-11-09T17:30:18+00:00 analyst — No vendor/maintainer advisory found: web-cli (Exa) out of credits, NVD page via WebFetch returned no content. Only NVD description known; fix and affected range beyond 6.2.4_6.2.5_0.614.0 unknown. Nothing verified. Revisit when search works: look for FrodoBots advisory/firmware release.

## From the sources

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.
1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.
2. ADB (Android Debug Bridge, port 5555) access to root shell
3. SSH (port 22)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_