Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| FrodoBots | FrodoBots EarthRover Mini+ firmware | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 09 Nov 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Mon, 09 Nov 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet. | |
| Title | CVE-2026-121686 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-11-09T16:24:04.920Z
Reserved: 2026-11-03T19:37:04.418Z
Link: CVE-2026-121686
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-09T17:17:16.797
Modified: 2026-11-09T17:17:16.797
Link: CVE-2026-121686
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T18:00:18Z
-
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')