Insecure Firmware Exposes Credentials in FrodoBots EarthRover Mini+ Products

CVE-2026-121689

What is CVE-2026-121689?

The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains a vulnerability that allows sensitive data exposure through various insecure mechanisms. The firmware stores Wi-Fi Pre-Shared Keys (PSK) in plaintext within the wpa_supplicant.conf file, which can be accessed through unauthenticated API endpoints. Additionally, unauthorized ADB access permits retrieval of the /etc/shadow file, exposing user credentials. This combination of issues poses significant security risks to users of the affected devices.

References