External risk intelligence

FrodoBots EarthRover Mini+ Firmware Hard-Coded Credentials Exposure.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121685

The product is a physical IoT device (EarthRover Mini+). While the hard-coded credentials exist within the firmware and interact with external cloud services like AWS and Slack, these credentials are embedded in client-side hardware firmware. Public internet exposure of the device itself depends on individual user deployment and network configuration, as these are typically managed devices rather than public-facing services.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects FrodoBots EarthRover Mini+ firmware, which contains multiple sets of hard-coded credentials. These include credentials for token services, AWS, and Slack, all accessible through static analysis of the firmware without special privileges. The main concern is confirming relevance and exposure given the nature of the product.

Embedded secrets expose sensitive access.
Hard-coded keys grant broad unauthorized access.
Verify device firmware for credential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can find hard-coded credentials within the publicly available firmware for the EarthRover Mini+, allowing them to gain access to various connected services. By performing static analysis on the firmware file, an attacker can extract fleet-wide credentials, including authentication details for an Agora token service, AWS access keys and IoT MQTT credentials, and a Slack webhook URL. This exposure could enable unauthorized control or data access.

Entry condition: Publicly accessible firmware.
Trigger point: Static firmware analysis.
Resulting risk: Unauthorized access to services.

Live Threat

Current exploitation, exposure, and threat context

The FrodoBots EarthRover Mini+ firmware embeds numerous hard-coded credentials, including fleet-wide access keys and tokens for services like AWS and Slack. These credentials can be discovered through static analysis of the firmware, potentially exposing sensitive system and user data when the device is deployed.

Hard-coded fleet credentials.
Accessible via firmware analysis.
May expose sensitive system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FrodoBots EarthRover Mini+ firmware contains hard-coded fleet-wide credentials, including AWS IAM keys and Slack webhooks, accessible via static analysis. Teams responsible for IoT device management, cloud infrastructure, and application security should prioritize identifying these devices, confirming their network exposure, and assessing business criticality. Once the scope is understood, an accountable owner must be assigned to plan and execute remediation based on the identified risks.

Identify affected devices and owners.
Verify network exposure and business impact.
Plan remediation or implement compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FrodoBots EarthRover Mini+?

The EarthRover Mini+ is an IoT device designed as a remotely operated rover. Its firmware serves as the onboard operating system that manages the hardware's connectivity, enabling it to communicate with cloud-based services like AWS and Slack for various telemetry and integration functions.

What does CWE-798 mean for CVE-2026-121685?

CWE-798 refers to the use of hard-coded credentials. In this CVE, it means sensitive authentication keys, such as AWS access tokens and API secrets, were permanently baked into the device's firmware code rather than being generated uniquely per user or stored securely.

How are these credentials triggered?

Access does not require an active network attack on a live device. Instead, the vulnerability is triggered by performing static analysis—simply opening and inspecting the publicly downloadable firmware file—which reveals the hidden credentials to anyone who downloads the file.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that while the credentials are in the firmware, actual risk depends on your specific deployment. Because the device is physical hardware, it is not always exposed to the public internet, though the embedded credentials themselves remain compromised.

What steps should I take if I use this rover?

Identify where these units are deployed in your network and assess whether they have permissions to access sensitive cloud resources. Since the credentials are hard-coded, consult the manufacturer for firmware updates or guidance on limiting the impact of potentially exposed service keys.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.