EARTHROVER MINI+ FIRMWARE · CVE-2026-121688 · Infrastructure
NO FIX YET
The EarthRover Mini+ downloads its STM32 motor-controller firmware over unencrypted HTTP and checks integrity only with an MD5 hash served in the same response. An attacker on the network path can replace the firmware with malicious code that runs on the motor controller.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners and operators of FrodoBots EarthRover Mini+ robots running firmware 6.2.4_6.2.5_0.614.0 are exposed when the robot fetches motor-controller updates. Anyone who can intercept or redirect that HTTP traffic, such as on a shared or untrusted network, can substitute firmware. Robots whose update path is not used or runs on a trusted isolated network are less exposed; the sources do not say whether a fixed version exists.
Not affected if firmware-updates-disabled, isolated-network
Who cares earthrover-mini-plus, frodobots, iot-firmware, robotics
No fix yet, per the sources.
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.