EARTHROVER MINI+ FIRMWARE · CVE-2026-121689 · Infrastructure
NO FIX YET
The EarthRover Mini+ robot firmware stores its Wi-Fi pre-shared key in plaintext and exposes it through unauthenticated API endpoints and diagnostic exports. Unauthenticated ADB access also lets an attacker retrieve the /etc/shadow password file.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Owners and operators of the FrodoBots EarthRover Mini+ running firmware v6.2.4_6.2.5_0.614.0, as listed in the NVD description. An attacker who can reach the robot's API or ADB on the network could read the Wi-Fi password and /etc/shadow. Whether ADB is on by default and whether a fixed firmware exists are unknown; no vendor page has been read.
Not affected if unknown
Who cares earthrover-mini-plus, frodobots, iot, robotics
No fix yet, per the sources.
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.