EN PT-BR
← Voltar ao feed
high

FrodoBots EarthRover Mini+ Firmware Flaws Allow Root Command Execution Across the Robot Fleet

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 22:41 · coletado há 1 hora

CERT/CC disclosed six flaws in the FrodoBots EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0 (kb.cert.org). The two most serious, CVE-2026-121685 and CVE-2026-121686, let anyone who extracts the shared cloud and MQTT secrets from the public firmware file send root shell commands to every rover in the fleet. Exploitation is not confirmed, no public exploit is reported, and the vendor says its researcher tested only a device they own. FrodoBots has revoked the hard-coded credentials and limited remote commands to single devices, which removes the fleet-wide reach, but the remaining fixes ship in a firmware update still in internal testing. Most of the other flaws need access to the rover's Wi-Fi access point or local interfaces, which narrows the risk for owners on trusted networks with a strong Wi-Fi password, so the rating is high rather than critical.

Entenda a falha

A vulnerabilidade

Six flaws affect the FrodoBots EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0. The worst two are CVE-2026-121685, fleet-wide hard-coded secrets (Agora, AWS IAM keys, AWS IoT MQTT credentials, a Slack webhook) readable from the public firmware with no privileges, and CVE-2026-121686, a firmware method that runs shell commands received over AWS IoT MQTT as root, gated only by the shared credentials. Together they let an outsider run root commands on every rover. The others are CVE-2026-121687 (unauthenticated REST API on port 80, ADB root shell on 5555 and SSH on 22), CVE-2026-121688 (unsigned motor-controller firmware over HTTP, MD5 only), CVE-2026-121689 (plaintext Wi-Fi PSK, /etc/shadow readable) and CVE-2026-121690 (everything runs as root). No CVSS score is published, and a full fix is not yet released.

Como funciona

The rover connects to cloud services and listens for management commands over AWS IoT MQTT. The firmware ships with the cloud and MQTT secrets embedded, and the firmware file is public. When a command arrives on the MQTT channel, a firmware method runs it as a shell command with root rights. The only check is that the sender holds the shared IoT credentials, and there is no per-device identity. Anyone who extracted those credentials could therefore reach the command channel of any rover. Separately, the local API, ADB and SSH services answer without login to anyone on the rover's network.

Por que é vulnerável

The design trusts shared, fleet-wide secrets baked into a publicly distributed firmware image, so the secrets are not secret. The command channel has no per-device authentication or authorization and passes commands to a root shell. Local services lack authentication, firmware updates rely on plain HTTP and an MD5 hash served in the same response with no code signing, the Wi-Fi PSK is stored in plaintext, and all processes run as root with no privilege separation. The vendor has revoked the credentials at their source and scoped remote commands to single devices. CERT/CC says arbitrary shell execution was removed, leaving only predefined management commands such as reboot. Hardening of local interfaces and the update mechanism is still pending.

Onde está

The CERT/CC note names the firmware's MQTT command-handling method, the wpa_supplicant.conf file, /etc/shadow, and the services on ports 80, 5555 and 22; no fix commit or function name is public.

Como foi descoberta

According to FrodoBots, researcher Justin Davis found the issues while testing a device he owns. CERT/CC disclosed the six flaws on November 9, 2026. The vendor says it has no indication that any vendor infrastructure or third-party device was accessed, and no exploitation is confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 23:16.

Detalhes técnicos

  • CVE-2026-121685: several sets of fleet-wide hard-coded secrets (Agora BasicAuth, AWS IAM keys, AWS IoT MQTT credentials and a Slack incoming webhook URL) can be read by static analysis of the public firmware, with no privileges required (kb.cert.org).
  • CVE-2026-121686: a firmware method runs shell commands received over AWS IoT MQTT as root. Access is gated only by the shared IoT credentials, with no per-device authentication (kb.cert.org).
  • CVE-2026-121687: the HTTP REST API on port 80, the ADB root shell on port 5555 and SSH on port 22 are exposed without authentication (kb.cert.org).
  • CVE-2026-121688: the STM32 motor-controller firmware is fetched over unencrypted HTTP, integrity is checked only with an MD5 hash served in the same response, and no code signing is implemented (kb.cert.org).
  • CVE-2026-121689: the Wi-Fi PSK is stored in plaintext in wpa_supplicant.conf and exposed through unauthenticated API endpoints and diagnostic exports, while unauthenticated ADB access allows reading /etc/shadow (kb.cert.org).
  • CVE-2026-121690: all processes run as root with no privilege separation, so compromising any single service yields full control of the device (kb.cert.org).
  • No CVSS score appears in the CERT/CC note. The article's 'Awaiting analysis' status is consistent with that.

Remediação

  • Per the vendor statement reproduced by CERT/CC, the hard-coded cloud credentials were revoked at their source and remote command authorization is scoped to individual devices (kb.cert.org).
  • The remaining items (removing the invalidated credential strings, hardening local interfaces and improving the firmware update mechanism) are in a firmware update in development and internal testing, to be rolled out progressively (kb.cert.org).
  • Until the update ships, operate the rover only on a trusted, private network, avoid shared or untrusted Wi-Fi, and set a strong password on the rover's Wi-Fi access point.
  • Once available, install the latest firmware. No firmware release notes or public fix commit were located in the pages opened for this report, and the FrodoBots homepage opened for it carries no security notice.

Relatos divergentes

  • The CERT/CC remediation table marks CVE-2026-121686 as addressed because arbitrary shell execution was removed, leaving only predefined management commands such as reboot (kb.cert.org). The article describes only the scoping of the command channel. The CERT/CC account is more specific.
  • The same CERT/CC table marks CVE-2026-121687 to CVE-2026-121690 as addressed or not remotely exploitable (kb.cert.org). The vendor statement in that note still lists local interface hardening as pending in the firmware update, so the vendor statement is treated as authoritative for these items.

Linha do tempo

  1. securityonline.info ↗ · pub. 09/11/2026 22:41 · coletado 09/11 23:00 primeiro registro

    FrodoBots EarthRover Mini+ Firmware Flaws Allow Root Command Execution Across the Robot Fleet

    ler a análise desta fonte

    CERT/CC disclosed six flaws in the FrodoBots EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0 (kb.cert.org). The two most serious, CVE-2026-121685 and CVE-2026-121686, let anyone who extracts the shared cloud and MQTT secrets from the public firmware file send root shell commands to every rover in the fleet. Exploitation is not confirmed, no public exploit is reported, and the vendor says its researcher tested only a device they own. FrodoBots has revoked the hard-coded credentials and limited remote commands to single devices, which removes the fleet-wide reach, but the remaining fixes ship in a firmware update still in internal testing. Most of the other flaws need access to the rover's Wi-Fi access point or local interfaces, which narrows the risk for owners on trusted networks with a strong Wi-Fi password, so the rating is high rather than critical.

    Technical Details

    • CVE-2026-121685: several sets of fleet-wide hard-coded secrets (Agora BasicAuth, AWS IAM keys, AWS IoT MQTT credentials and a Slack incoming webhook URL) can be read by static analysis of the public firmware, with no privileges required (kb.cert.org).
    • CVE-2026-121686: a firmware method runs shell commands received over AWS IoT MQTT as root. Access is gated only by the shared IoT credentials, with no per-device authentication (kb.cert.org).
    • CVE-2026-121687: the HTTP REST API on port 80, the ADB root shell on port 5555 and SSH on port 22 are exposed without authentication (kb.cert.org).
    • CVE-2026-121688: the STM32 motor-controller firmware is fetched over unencrypted HTTP, integrity is checked only with an MD5 hash served in the same response, and no code signing is implemented (kb.cert.org).
    • CVE-2026-121689: the Wi-Fi PSK is stored in plaintext in wpa_supplicant.conf and exposed through unauthenticated API endpoints and diagnostic exports, while unauthenticated ADB access allows reading /etc/shadow (kb.cert.org).
    • CVE-2026-121690: all processes run as root with no privilege separation, so compromising any single service yields full control of the device (kb.cert.org).
    • No CVSS score appears in the CERT/CC note. The article's 'Awaiting analysis' status is consistent with that.

    Remediation

    • Per the vendor statement reproduced by CERT/CC, the hard-coded cloud credentials were revoked at their source and remote command authorization is scoped to individual devices (kb.cert.org).
    • The remaining items (removing the invalidated credential strings, hardening local interfaces and improving the firmware update mechanism) are in a firmware update in development and internal testing, to be rolled out progressively (kb.cert.org).
    • Until the update ships, operate the rover only on a trusted, private network, avoid shared or untrusted Wi-Fi, and set a strong password on the rover's Wi-Fi access point.
    • Once available, install the latest firmware. No firmware release notes or public fix commit were located in the pages opened for this report, and the FrodoBots homepage opened for it carries no security notice.

    Conflicting Reports

    • The CERT/CC remediation table marks CVE-2026-121686 as addressed because arbitrary shell execution was removed, leaving only predefined management commands such as reboot (kb.cert.org). The article describes only the scoping of the command channel. The CERT/CC account is more specific.
    • The same CERT/CC table marks CVE-2026-121687 to CVE-2026-121690 as addressed or not remotely exploitable (kb.cert.org). The vendor statement in that note still lists local interface hardening as pending in the firmware update, so the vendor statement is treated as authoritative for these items.