External risk intelligence

FrodoBots EarthRover Mini+ Unauthenticated Local Interfaces Expose Sensitive Data and Control

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-121687

The device is a consumer-grade robotic rover. While it exposes local network interfaces (HTTP, ADB, SSH) that lack authentication, these are intended for operation within a local area network (LAN). Public internet exposure is uncommon for this product class, as these devices are typically deployed behind residential firewalls or NATs and are not designed to be directly reachable from the public internet.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in FrodoBots EarthRover Mini+ firmware that exposes unauthenticated local interfaces, including an HTTP REST API for device control and diagnostics, ADB access to a root shell, and SSH access. These vulnerabilities could allow unauthorized individuals to potentially control device functions, access sensitive information like WiFi passwords, or execute commands on the device if they gain local network access.

Unauthenticated access to device controls and data.
Risk of unauthorized local network control.
Confirm device presence and network exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to the FrodoBots EarthRover Mini+ through its unauthenticated local network interfaces. Once connected, they could leverage exposed features like the HTTP REST API or ADB to control the device's motor, access sensitive information such as WiFi passwords, or even obtain a root shell. This level of access could allow for significant disruption or data compromise.

Unauthenticated network access required.
Vulnerable local interfaces (HTTP, ADB, SSH).
Risk of device control and data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user on the same local network as the FrodoBots EarthRover Mini+ to access sensitive device information, control its motor, and potentially connect to arbitrary Wi-Fi networks. Access to the root shell via ADB or SSH may also be possible.

Device telemetry and WiFi credentials at risk.
Unauthenticated local network access.
Unauthorized control or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects FrodoBots EarthRover Mini+ devices. The primary teams likely responsible for managing these devices are the owners of the specific robotic assets, which could be research teams, individual users, or specific departments within an organization. The immediate first step is to identify all deployed EarthRover Mini+ units, confirm their network reachability and business criticality, and then identify the accountable owner for each device to plan appropriate remediation.

Asset owners should manage this issue.
Verify device network exposure and criticality.
Plan risk-based remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FrodoBots EarthRover Mini+?

The EarthRover Mini+ is a consumer-grade robotic rover. It serves as a mobile platform often used for remote exploration, research, or hobbyist projects. The device includes firmware that enables connectivity features like motor control and telemetry, which rely on internal network interfaces to communicate with controllers or diagnostic tools.

What does CWE-306 mean for CVE-2026-121687?

CWE-306 refers to 'Missing Authentication for Critical Function.' In the context of this CVE, it means the software performs sensitive actions—such as providing root shell access or revealing Wi-Fi credentials—without verifying the identity of the user. Because these interfaces lack a login mechanism, anyone who can reach the device on the network can interact with it as if they were the authorized owner.

How can someone trigger this vulnerability?

An attacker triggers this by connecting to the EarthRover Mini+ via the local network. They do not need to exploit a complex bug; they simply send requests to the exposed HTTP API, ADB, or SSH ports. Importantly, this cannot be triggered by someone who lacks network access to the device. If the rover is isolated from the network or behind a restricted firewall, the interfaces remain unreachable to unauthorized users.

Is my device at risk if it is not on the public internet?

According to Halo Surface Signal, this device is typically used behind residential firewalls or NATs. While internet exposure is uncommon for this product class, the risk remains for anyone who can access your local network. If an unauthorized person or a compromised device joins your Wi-Fi, they could potentially reach the rover's interfaces, as the device does not differentiate between trusted and untrusted local users.

How should I respond to this threat advisory?

Start by identifying all EarthRover Mini+ units you are responsible for and confirm where they are deployed. Since these devices have open interfaces by default, you should ensure they are not reachable from outside your local network. Consult with the vendor for available firmware updates and coordinate with your internal teams to manage the risk until a patch or configuration change can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.