---
id: "CVE-2026-121688"
page: "https://infrastack.ai/live/CVE-2026-121688"
kind: "vulnerability"
aliases: ["CVE-2026-121688"]
title: "FrodoBots EarthRover Mini+ robot: STM32 firmware updates fetched over plain HTTP"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EarthRover Mini+ firmware", "fixed": [], "affected": "6.2.4_6.2.5_0.614.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["earthrover-mini-plus", "frodobots", "infrastructure", "iot-firmware", "robotics"]
not_affected_if: ["firmware-updates-disabled", "isolated-network"]
published_at: "2026-11-09T17:17:17+00:00"
first_seen_at: "2026-11-09T17:27:38+00:00"
updated_at: "2026-11-09T17:30:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121688", "first_seen_at": "2026-11-09T17:27:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T17:30:22+00:00"}]
exploit_sources: []
---

# FrodoBots EarthRover Mini+ robot: STM32 firmware updates fetched over plain HTTP

Link for people: https://infrastack.ai/live/CVE-2026-121688 (this .md is for agents)

The EarthRover Mini+ downloads its STM32 motor-controller firmware over unencrypted HTTP and checks integrity only with an MD5 hash served in the same response. An attacker on the network path can replace the firmware with malicious code that runs on the motor controller.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EarthRover Mini+ firmware affected 6.2.4_6.2.5_0.614.0 fixed no fixed version listed

## How to check

Check the robot's firmware version; NVD lists 6.2.4_6.2.5_0.614.0 as affected. Whether other versions are affected is unknown. To see exposure, capture the robot's traffic during an update and look for the STM32 firmware download over plain http:// with an MD5 hash in the same response.

## Timeline

- 2026-11-09T17:27:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121688
- 2026-11-09T17:30:22+00:00 analyst — Only the NVD description was available. web-cli had no credits (402), and WebFetch returned no usable NVD content. No vendor advisory was found or read, so the fix is unknown, nothing is verified, and fix_status is left unset. Revisit to look for a FrodoBots advisory or fixed firmware.

## From the sources

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_