FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Frodobots |
|
No data.
No data.
References
History
Thu, 12 Nov 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 10 Nov 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Frodobots
Frodobots frodobots Earthrover Mini+ Firmware |
|
| Vendors & Products |
Frodobots
Frodobots frodobots Earthrover Mini+ Firmware |
Mon, 09 Nov 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-200 CWE-284 CWE-311 CWE-522 |
Mon, 09 Nov 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file. | |
| Title | CVE-2026-121689 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: certcc
Published: 2026-11-09T16:27:03.106Z
Updated: 2026-11-12T16:56:37.142Z
Reserved: 2026-11-03T19:37:38.749Z
Link: CVE-2026-121689
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-09T17:17:17.120
Modified: 2026-11-12T19:22:01.433
Link: CVE-2026-121689
Redhat
No data.