FrodoBots robot firmware exposed fleet-wide credentials, CERT/CC says

FrodoBots robot firmware exposed fleet-wide credentials, CERT/CC says

10 November 2026: CERT/CC has published six CVEs for the FrodoBots EarthRover Mini+, an internet-connected mobile robot with camera and microphone, led by fleet-wide hard-coded cloud credentials (CVE-2026-121685) and root command execution over MQTT (CVE-2026-121686). No exploitation is reported. The vendor says it has revoked the cloud keys, and owners are told to update and to run the device only on a trusted private network.

Not yet independently verified. CERT/CC gives no fixed firmware version number, and the remediation status comes from the vendor's statement of July 2026. No exploitation has been reported. We will update this when it can be confirmed, and remove this note.

One binary with the keys to the fleet

Firmware 6.2.4_6.2.5_0.614.0 carried the same secrets in every unit. Inside frodobot.bin were Agora token service credentials, AWS IAM access keys, AWS IoT MQTT credentials and a Slack webhook URL. CVE-2026-121686 turned that into a fleet problem, since the firmware accepted arbitrary shell commands over AWS IoT MQTT and ran them as root, gated only by those shared credentials.

Open ports and an unsigned update path

The remaining four flaws concern the device and its update mechanism:

• CVE-2026-121687: unauthenticated local interfaces, with an HTTP API on port 80 revealing the Wi-Fi password and GPS and IMEI data, an ADB root shell on port 5555, and SSH on port 22
• CVE-2026-121688: STM32 motor controller firmware fetched over plain HTTP, with its MD5 hash in the same unprotected response and no code signing
• CVE-2026-121689: the Wi-Fi key stored in plain text and exposed through diagnostic exports, with /etc/shadow readable over ADB
• CVE-2026-121690: every process runs as root

What the vendor says it has done

The vendor was told on 11 June. In a statement dated 12 July it said cloud credentials had been revoked at source and remote command authorisation had been scoped to individual devices. CERT/CC records CVE-2026-121685 and 121686 as addressed, noting that one Agora token credential remains and that only a few predefined management commands, such as reboot, are left. The other four are listed as addressed or not remotely exploitable under the current deployment model, according to the vendor.

Removal of the credential strings, local interface hardening and the update mechanism are in a firmware release described as in development and internal testing, to be rolled out progressively. Users are told to take the latest firmware, but no version number is given.

A pattern for anyone buying connected robots

CERT/CC describes the product as used in educational and consumer settings, but the findings read as a checklist for a robot supplier of any size. A business evaluating mobile robots can ask whether credentials are per device, whether cloud commands are authorised per unit, whether debug ports are closed in production, and whether firmware for each controller is signed. Justin Davis reported the flaws.

Our robot manufacturer category lists 62 companies.

Company profile on TrustList: FrodoBots

Sources

• CERT/CC Vulnerability Note VU#188754, 9 November 2026