{"id":"CVE-2026-121685","published":"2026-11-09T17:17:16.680","lastModified":"2026-11-09T17:17:16.680","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/frodobots-org","tags":[]},{"url":"https://kb.cert.org/vuls/id/188754","tags":[]},{"url":"https://www.frodobots.ai/","tags":[]}],"exploitRefs":[{"url":"https://github.com/frodobots-org","tags":[]}],"hasPoc":true,"ai":null}