{"id":"CVE-2026-121687","published":"2026-11-09T17:17:16.900","lastModified":"2026-11-09T17:17:16.900","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/frodobots-org","tags":[]},{"url":"https://kb.cert.org/vuls/id/188754","tags":[]},{"url":"https://www.frodobots.ai/","tags":[]}],"exploitRefs":[{"url":"https://github.com/frodobots-org","tags":[]}],"hasPoc":true,"ai":null}