Multiple Hard-Coded Credentials in FrodoBots EarthRover Mini+ Firmware

CVE-2026-121685

What is CVE-2026-121685?

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple hard-coded credentials, posing significant security risks. These include fleet-wide BasicAuth credentials for an Agora token service, as well as AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. The sensitive credentials are directly embedded within the frodobot.bin file, which can be accessed through static analysis of the publicly downloadable firmware, requiring no special privileges for extraction. This presents a major threat to the integrity and confidentiality of systems utilizing this firmware.

References