FrodoBots vulnerabilities
We track 4 vulnerabilities in FrodoBots products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest FrodoBots vulnerabilities
- 9.1 Critical severity
FrodoBots EarthRover Mini+ firmware: Download of Code Without Integrity Check
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the sam
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Missing Authentication for Critical Functionality
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Improper Neutralization of Special Elements used in an OS Command
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetr
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Use of Hard-coded Credentials
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials,