CVE-2026-121686
Summary
| CVE | CVE-2026-121686 |
|---|---|
| State | PUBLISHED |
| Assigner | certcc |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-09 17:17:16 UTC |
| Updated | 2026-11-09 17:17:16 UTC |
| Description | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet. |
Risk And Classification
Problem Types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | FrodoBots | FrodoBots EarthRover Mini Firmware | affected 6.2.4_6.2.5_0.614.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/frodobots-org | [email protected] | github.com | |
| kb.cert.org/vuls/id/188754 | [email protected] | kb.cert.org | |
| www.frodobots.ai | [email protected] | www.frodobots.ai | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.