CVE-2026-121688
Last modified
CVE-2026-121688 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| FrodoBots | FrodoBots EarthRover Mini+ firmware | 6.2.4_6.2.5_0.614.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-121688?
How severe is CVE-2026-121688?
How do I fix CVE-2026-121688?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121680Exposure of sensitive information to an unauthorized actor i…7.5
- CVE-2026-121681Heap-based buffer overflow in Microsoft Trace Data Helper al…7.8
- CVE-2026-121683Missing authentication in Ivanti Cloud Services Application …9.4
- CVE-2026-121685FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.6…9.8
- CVE-2026-121686FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.6…9.8
- CVE-2026-121687FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.6…9.8
- CVE-2026-121689FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) e…7.5
- CVE-2026-121690FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.6…6.7
- CVE-2026-121691Improper Handling of Highly Compressed Data (CWE-409) in the…6.7
- CVE-2026-1217The Yoast Duplicate Post plugin for WordPress is vulnerable …5.4
- CVE-2026-12170The AcyMailing – An Ultimate Newsletter Plugin and Marketing…6.4
- CVE-2026-12171auto-changelog before 2.6.1 merges configuration from inside…7.8
Are you affected by CVE-2026-121688?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST