{"id":"CVE-2026-121690","kind":"vulnerability","aliases":["CVE-2026-121690"],"related":[],"title":"FrodoBots EarthRover Mini+ firmware: all processes run as root","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.","summary":"The EarthRover Mini+ robot firmware, version 6.2.4_6.2.5_0.614.0, runs every process as root with no privilege separation. Compromising any single service gives an attacker full administrative control of the device.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["earthrover-mini-plus","frodobots","infrastructure","iot","robotics"],"not_affected_if":["other-firmware-version"],"how_to_check":"- Confirm the device runs EarthRover Mini+ firmware `6.2.4_6.2.5_0.614.0` (unknown whether the sources give a check command)\n- Check whether services on the device run as root (unknown whether the sources give a specific command)","fix":null,"status":"open","published_at":"2026-11-09T17:17:17+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","triaged_at":"2026-11-09T17:29:04+00:00","updated_at":"2026-11-09T17:29:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-09T17:29:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FrodoBots EarthRover Mini+ firmware: all processes run as root","impact":"high","summary":"The EarthRover Mini+ robot firmware, version 6.2.4_6.2.5_0.614.0, runs every process as root with no privilege separation. Compromising any single service gives an attacker full administrative control of the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["frodobots","earthrover-mini-plus","robotics","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains full administrative control of the robot","analyst_note":"Find the vendor advisory or the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-121690) for the fixed firmware version, the network exposure of the device, and whether authentication is needed to reach the vulnerable service.","how_to_check":"- Confirm the device runs EarthRover Mini+ firmware `6.2.4_6.2.5_0.614.0` (unknown whether the sources give a check command)\n- Check whether services on the device run as root (unknown whether the sources give a specific command)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-version"],"who_is_affected":"Any EarthRover Mini+ robot running firmware version 6.2.4_6.2.5_0.614.0, since all of its processes run as root. Teams that operate these robots should look at whether their units run this firmware. Units on other firmware versions are not named in the source.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4550,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121690':12A,15A '-2026':11A,14A '0.614.0':32B,62C '6.2.4':30B,60C '6.2.5':31B,61C 'administr':50B,88C 'attack':48B 'code':64C 'compromis':42B,80C 'control':51B,89C 'cve':10A,13A 'devic':54B,92C 'earthrov':2A,17B,25B,56C 'earthrover-mini-plus':16B 'everi':34B 'execut':63C 'firmwar':4A,28B,58C 'frodobot':1A,20B,55C 'full':49B,87C 'give':46B 'infrastructur':21B 'iot':22B 'lack':76C 'mini':3A,18B,26B,57C 'plus':19B 'privileg':40B,67C,77C 'process':6A,35B,69C 'result':85C 'robot':23B,27B 'root':9A,37B,72C 'run':7A,33B,70C 'separ':41B,78C 'servic':45B,84C 'singl':44B,83C 'system':75C 'unnecessari':66C 'version':29B,59C","nicknames":[],"mitigations":[],"who_affected":"Any EarthRover Mini+ robot running firmware version 6.2.4_6.2.5_0.614.0, since all of its processes run as root. Teams that operate these robots should look at whether their units run this firmware. Units on other firmware versions are not named in the source.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["earthroverminiplus","frodobots","infrastructure","iot","robotics","unknown"],"campaign_type":null,"search_a":"'-121690':12A,15A '-2026':11A,14A 'cve':10A,13A 'earthrov':2A 'firmwar':4A 'frodobot':1A 'mini':3A 'process':6A 'root':9A 'run':7A","search_b":"'0.614.0':32B '6.2.4':30B '6.2.5':31B 'administr':50B 'attack':48B 'compromis':42B 'control':51B 'devic':54B 'earthrov':17B,25B 'earthrover-mini-plus':16B 'everi':34B 'firmwar':28B 'frodobot':20B 'full':49B 'give':46B 'infrastructur':21B 'iot':22B 'mini':18B,26B 'plus':19B 'privileg':40B 'process':35B 'robot':23B,27B 'root':37B 'run':33B 'separ':41B 'servic':45B 'singl':44B 'version':29B","search_c":"'0.614.0':62C '6.2.4':60C '6.2.5':61C 'administr':88C 'code':64C 'compromis':80C 'control':89C 'devic':92C 'earthrov':56C 'execut':63C 'firmwar':58C 'frodobot':55C 'full':87C 'lack':76C 'mini':57C 'privileg':67C,77C 'process':69C 'result':85C 'root':72C 'run':70C 'separ':78C 'servic':84C 'singl':83C 'system':75C 'unnecessari':66C 'version':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121690","severity":null,"published_at":"2026-11-09T17:17:17+00:00","modified_at":"2026-11-09T17:17:17+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","fetched_at":"2026-11-09T17:27:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}