CVE-2026-121688
Summary
| CVE | CVE-2026-121688 |
|---|---|
| State | PUBLISHED |
| Assigner | certcc |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-09 17:17:17 UTC |
| Updated | 2026-11-09 17:17:17 UTC |
| Description | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code. |
Risk And Classification
Problem Types: CWE-494 Download of Code Without Integrity Check
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | FrodoBots | FrodoBots EarthRover Mini Firmware | affected 6.2.4_6.2.5_0.614.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/frodobots-org | [email protected] | github.com | |
| kb.cert.org/vuls/id/188754 | [email protected] | kb.cert.org | |
| www.frodobots.ai | [email protected] | www.frodobots.ai | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.