---
id: "CVE-2026-121689"
page: "https://infrastack.ai/live/CVE-2026-121689"
kind: "vulnerability"
aliases: ["CVE-2026-121689"]
title: "FrodoBots EarthRover Mini+ firmware leaks Wi-Fi password and system credentials"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EarthRover Mini+ firmware", "fixed": [], "affected": "v6.2.4_6.2.5_0.614.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["earthrover-mini-plus", "frodobots", "infrastructure", "iot", "robotics"]
not_affected_if: ["unknown"]
published_at: "2026-11-09T17:17:17+00:00"
first_seen_at: "2026-11-09T17:27:38+00:00"
updated_at: "2026-11-09T17:30:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121689", "first_seen_at": "2026-11-09T17:27:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T17:30:23+00:00"}]
exploit_sources: []
---

# FrodoBots EarthRover Mini+ firmware leaks Wi-Fi password and system credentials

Link for people: https://infrastack.ai/live/CVE-2026-121689 (this .md is for agents)

The EarthRover Mini+ robot firmware stores its Wi-Fi pre-shared key in plaintext and exposes it through unauthenticated API endpoints and diagnostic exports. Unauthenticated ADB access also lets an attacker retrieve the /etc/shadow password file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EarthRover Mini+ firmware affected v6.2.4_6.2.5_0.614.0 fixed no fixed version listed

## How to check

Unconfirmed. Per the NVD description, the affected firmware is v6.2.4_6.2.5_0.614.0. Check the firmware version on the device. Also check whether ADB is reachable without authentication on your network (adb connect <robot-ip>:5555) and whether the robot's API returns the Wi-Fi PSK without login. Neither check is confirmed by a vendor page.

## Timeline

- 2026-11-09T17:27:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121689
- 2026-11-09T17:30:23+00:00 analyst — Could not reach primary sources: web-cli out of Exa credits, NVD page via WebFetch returned no content. No FrodoBots advisory read, so fix, affected range and ADB default are unknown. Nothing verified. Settle by reading the FrodoBots advisory/firmware release notes for a version after v6.2.4_6.2.5_0.614.0.

## From the sources

FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_