External risk intelligence

FrodoBots EarthRover Mini+ Firmware Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121686

The vulnerability affects an IoT device that communicates via AWS IoT MQTT. Because these devices are designed to maintain persistent, remote connectivity to a cloud-based message broker for control and management, they represent an externally reachable surface by design in common deployment patterns.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the FrodoBots EarthRover Mini+ firmware, allowing unauthenticated remote code execution through AWS IoT MQTT messages. This flaw enables attackers to execute arbitrary commands as root on affected devices, posing a significant risk to the entire fleet if exposed.

Remote attackers can run any command on affected devices.
This impacts devices connected to AWS IoT MQTT services.
Confirming device relevance and potential exposure is the primary concern.

Attack Path

How an attacker could exploit the issue

An attacker can compromise FrodoBots EarthRover Mini+ devices by sending specially crafted MQTT messages. These messages, delivered over AWS IoT MQTT, can contain arbitrary shell commands. Since the firmware does not enforce per-device authentication, an attacker only needs to possess valid IoT credentials to execute these commands with root privileges on the affected devices.

Unauthenticated remote access required.
MQTT messages trigger arbitrary commands.
Root-level code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands with root privileges on FrodoBots EarthRover Mini+ devices. When a device is configured to use AWS IoT MQTT for communication, and if the attacker possesses the correct IoT credentials, they can send specially crafted MQTT messages to the device. These messages can contain commands that the device's firmware will execute, potentially impacting the device's operation and any data it manages.

Device firmware and control
Via unauthenticated MQTT commands
Root-level compromise of device

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this critical vulnerability falls to teams managing IoT deployments and the associated cloud infrastructure. The immediate priority is to identify all FrodoBots EarthRover Mini+ devices, confirm their exposure to the internet or untrusted networks via AWS IoT MQTT, and ascertain their business criticality. Once accountable owners are identified, a risk-based remediation plan should be developed, potentially involving network segmentation, credential rotation, or firmware updates, coordinated with vendor management if necessary.

Own by IoT platform and security teams.
Verify fleet exposure and AWS IoT MQTT reachability.
Plan phased remediation based on criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FrodoBots EarthRover Mini+?

The EarthRover Mini+ is an IoT device that utilizes custom firmware to interact with users and cloud services. It is designed to maintain persistent remote connectivity to the AWS IoT ecosystem, allowing the robot to receive control signals and management commands over the internet through the MQTT messaging protocol.

What does CVE-2026-121686 mean by OS command injection?

This vulnerability falls under CWE-78, which refers to improper neutralization of special elements used in an OS command. In this case, the firmware fails to validate or restrict inputs within MQTT messages. As a result, an attacker can embed malicious system commands into these messages, which the device then executes with the highest level of system privilege, known as root access.

How can an attacker trigger this vulnerability?

An attacker must send a specially crafted MQTT message containing arbitrary shell commands to the device via the AWS IoT platform. The trigger relies on the use of shared IoT credentials rather than unique, per-device authentication. It is important to note that sending standard, non-malicious control signals or interacting with the device through other non-MQTT communication channels will not trigger this specific command execution flaw.

Is my device relevant to this threat?

According to Halo Surface Signal, this vulnerability is considered a high priority for awareness because the device is designed to maintain constant, remote connectivity to a cloud broker. If you operate an EarthRover Mini+ that is currently configured to connect to AWS IoT MQTT services, your device is reachable by design, regardless of whether it is located on a local network or exposed directly to the internet.

What steps should I take to respond?

First, locate all EarthRover Mini+ units in your fleet and verify their current connection status to AWS IoT services. Since the vulnerability involves shared credentials, evaluate your access control policies for these IoT platforms immediately. Plan for a controlled remediation process that may include updating device firmware, rotating shared credentials, or implementing network-level restrictions to limit communication with the cloud broker.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.