Remote Code Execution Vulnerability in FrodoBots EarthRover Mini+ Firmware

CVE-2026-121686

What is CVE-2026-121686?

The FrodoBots EarthRover Mini+ firmware contains a vulnerability that could allow unauthenticated remote code execution through messages sent via the MQTT protocol. This issue arises from a firmware method that indiscriminately accepts shell commands delivered through AWS IoT MQTT without proper device-level authentication. As access is only limited by shared IoT credentials, an attacker can leverage this flaw to execute arbitrary commands with root privileges across all affected devices, potentially compromising the entire fleet.

References