{"api_version":"1","generated_at":"2026-11-10T04:44:57+00:00","cve":"CVE-2026-121686","urls":{"html":"https://cve.report/CVE-2026-121686","api":"https://cve.report/api/cve/CVE-2026-121686.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-121686","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-121686"},"summary":{"title":"CVE-2026-121686","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.","state":"PUBLISHED","assigner":"certcc","published_at":"2026-11-09 17:17:16","updated_at":"2026-11-09 17:17:16"},"problem_types":["CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[],"references":[{"url":"https://github.com/frodobots-org","name":"https://github.com/frodobots-org","refsource":"cret@cert.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://kb.cert.org/vuls/id/188754","name":"https://kb.cert.org/vuls/id/188754","refsource":"cret@cert.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.frodobots.ai/","name":"https://www.frodobots.ai/","refsource":"cret@cert.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121686","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121686","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FrodoBots","product":"FrodoBots EarthRover Mini+ firmware","version":"affected 6.2.4_6.2.5_0.614.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet."}],"problemTypes":[{"descriptions":[{"description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T16:24:04.920Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://www.frodobots.ai/"},{"url":"https://github.com/frodobots-org"},{"url":"https://kb.cert.org/vuls/id/188754"}],"source":{"discovery":"UNKNOWN"},"title":"CVE-2026-121686","x_generator":{"engine":"VINCE 4.0.2","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-121686"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-121686","datePublished":"2026-11-09T16:24:04.920Z","dateReserved":"2026-11-03T19:37:04.418Z","dateUpdated":"2026-11-09T16:24:04.920Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 17:17:16","lastModifiedDate":"2026-11-09 17:17:16","problem_types":["CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"121686","Ordinal":"1","Title":"CVE-2026-121686","CVE":"CVE-2026-121686","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"121686","Ordinal":"1","NoteData":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.","Type":"Description","Title":"CVE-2026-121686"}]}}}