Insecure Firmware Update Mechanism in FrodoBots EarthRover Mini+

CVE-2026-121688

What is CVE-2026-121688?

The firmware for FrodoBots' EarthRover Mini+ is compromised by an insecure update mechanism. Specifically, the STM32 motor-controller firmware is fetched using unencrypted HTTP, exposing the process to interception and manipulation. Moreover, integrity checks rely solely on MD5, and the hash is disclosed in the same unprotected response, which can lead to unauthorized firmware modifications. This lack of code-signing creates a significant risk, as malicious actors could inject harmful code into the firmware, potentially compromising the device's functionality and user safety.

References