{"id":"CVE-2026-121688","kind":"vulnerability","aliases":["CVE-2026-121688"],"related":[],"title":"FrodoBots EarthRover Mini+ robot: STM32 firmware updates fetched over plain HTTP","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.","summary":"The EarthRover Mini+ downloads its STM32 motor-controller firmware over unencrypted HTTP and checks integrity only with an MD5 hash served in the same response. An attacker on the network path can replace the firmware with malicious code that runs on the motor controller.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EarthRover Mini+ firmware","fixed":[],"affected":"6.2.4_6.2.5_0.614.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["earthrover-mini-plus","frodobots","infrastructure","iot-firmware","robotics"],"not_affected_if":["firmware-updates-disabled","isolated-network"],"how_to_check":"Check the robot's firmware version; NVD lists 6.2.4_6.2.5_0.614.0 as affected. Whether other versions are affected is unknown. To see exposure, capture the robot's traffic during an update and look for the STM32 firmware download over plain http:// with an MD5 hash in the same response.","fix":null,"status":"open","published_at":"2026-11-09T17:17:17+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:29:04+00:00","updated_at":"2026-11-09T17:30:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T17:29:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FrodoBots EarthRover Mini+ robot: STM32 firmware updates fetched over plain HTTP","impact":"high","summary":"The EarthRover Mini+ downloads its STM32 motor-controller firmware over unencrypted HTTP and checks integrity only with an MD5 hash served in the same response. An attacker on the network path can replace the firmware with malicious code that runs on the motor controller.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["frodobots","earthrover-mini-plus","robotics","iot-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker replaces motor-controller firmware with malicious code","analyst_note":"Check the FrodoBots vendor advisory and NVD entry for a fixed firmware version and whether the update channel has changed to HTTPS with signing.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["isolated-network","firmware-updates-disabled"],"who_is_affected":"Owners and operators of FrodoBots EarthRover Mini+ robots running firmware 6.2.4_6.2.5_0.614.0 are exposed when the robot fetches motor-controller updates. Anyone who can intercept or redirect that HTTP traffic, such as on a shared or untrusted network, can substitute firmware. Robots whose update path is not used or runs on a trusted isolated network are less exposed; the sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4617,"output_tokens":586,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the FrodoBots vendor advisory and NVD entry for a fixed firmware version and whether the update channel has changed to HTTPS with signing.","search":"'-121688':14A,17A '-2026':13A,16A '0.614.0':83C '6.2.4':81C '6.2.5':82C 'allow':122C 'attack':58B 'check':45B 'code':69B,117C,130C 'contain':84C 'control':39B,75B,94C 'cve':12A,15A 'download':34B 'earthrov':2A,22B,32B,77C 'earthrover':18A 'earthrover-mini-plus':21B 'fetch':8A,97C 'firmwar':6A,29B,40B,66B,79C,88C,95C,123C 'firmware':20A 'frodobot':1A,25B,76C 'hash':51B,109C 'http':11A,43B,100C 'implement':121C 'infrastructur':26B 'insecur':86C 'integr':46B,101C 'iot':28B 'iot-firmwar':27B 'malici':68B,129C 'md5':50B,106C 'mechan':90C,119C 'mini':3A,19A,23B,33B,78C 'motor':38B,74B,93C 'motor-control':37B 'network':61B 'path':62B 'plain':10A 'plus':24B 'potenti':128C 'provid':110C 'replac':64B,126C 'respons':56B,115C 'robot':4A,30B 'run':71B 'serv':52B 'sign':118C 'stm32':5A,36B,87C,92C 'unencrypt':42B,99C 'unprotect':114C 'updat':7A,89C 'valid':103C 'version':80C 'via':105C","nicknames":[],"mitigations":[],"who_affected":"Owners and operators of FrodoBots EarthRover Mini+ robots running firmware 6.2.4_6.2.5_0.614.0 are exposed when the robot fetches motor-controller updates. Anyone who can intercept or redirect that HTTP traffic, such as on a shared or untrusted network, can substitute firmware. Robots whose update path is not used or runs on a trusted isolated network are less exposed; the sources do not say whether a fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["earthroverminifirmware","minifirmware"],"ptokens":["earthrover","firmware","mini"],"labels":["earthroverminiplus","frodobots","high","infrastructure","iotfirmware","robotics"],"campaign_type":null,"search_a":"'-121688':14A,17A '-2026':13A,16A 'cve':12A,15A 'earthrov':2A 'earthrover':18A 'fetch':8A 'firmwar':6A 'firmware':20A 'frodobot':1A 'http':11A 'mini':3A,19A 'plain':10A 'robot':4A 'stm32':5A 'updat':7A","search_b":"'attack':58B 'check':45B 'code':69B 'control':39B,75B 'download':34B 'earthrov':22B,32B 'earthrover-mini-plus':21B 'firmwar':29B,40B,66B 'frodobot':25B 'hash':51B 'http':43B 'infrastructur':26B 'integr':46B 'iot':28B 'iot-firmwar':27B 'malici':68B 'md5':50B 'mini':23B,33B 'motor':38B,74B 'motor-control':37B 'network':61B 'path':62B 'plus':24B 'replac':64B 'respons':56B 'robot':30B 'run':71B 'serv':52B 'stm32':36B 'unencrypt':42B","search_c":"'0.614.0':83C '6.2.4':81C '6.2.5':82C 'allow':122C 'code':117C,130C 'contain':84C 'control':94C 'earthrov':77C 'fetch':97C 'firmwar':79C,88C,95C,123C 'frodobot':76C 'hash':109C 'http':100C 'implement':121C 'insecur':86C 'integr':101C 'malici':129C 'md5':106C 'mechan':90C,119C 'mini':78C 'motor':93C 'potenti':128C 'provid':110C 'replac':126C 'respons':115C 'sign':118C 'stm32':87C,92C 'unencrypt':99C 'unprotect':114C 'updat':89C 'valid':103C 'version':80C 'via':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121688","severity":null,"published_at":"2026-11-09T17:17:17+00:00","modified_at":"2026-11-09T17:17:17+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121688:2307","url":null,"severity":null,"published_at":"2026-11-09T17:30:22+00:00","modified_at":"2026-11-09T17:30:22+00:00","first_seen_at":"2026-11-09T17:30:22+00:00","fetched_at":"2026-11-09T17:30:22+00:00","note":"Only the NVD description was available. web-cli had no credits (402), and WebFetch returned no usable NVD content. No vendor advisory was found or read, so the fix is unknown, nothing is verified, and fix_status is left unset. Revisit to look for a FrodoBots advisory or fixed firmware."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}