Unauthenticated Local Interfaces in FrodoBots EarthRover Mini+ Firmware

CVE-2026-121687

What is CVE-2026-121687?

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple local interfaces that are exposed without the necessary authentication measures. These vulnerabilities allow unauthorized access to critical functionalities, including an HTTP REST API listening on port 80 that supports motor control, telemetry, and the retrieval of plaintext WiFi passwords. Additionally, the Android Debug Bridge (ADB) on port 5555 enables root shell access, while SSH services on port 22 can further compromise the device's security.

References