FrodoBots EarthRover Mini+ firmware is vulnerable to unauthenticated remote code execution via MQTT. The firmware contains a method that accepts arbitrary shell commands delivered through Amazon Web Services IoT MQTT messages and executes them as root. Access is controlled only by shared IoT credentials, with no per‑device authentication, allowing an attacker to run root‑privileged commands across the entire fleet.

The affected product is FrodoBots EarthRover Mini+ firmware, specifically versions 6.2.4, 6.2.5, and 0.614.0.

The flaw permits an attacker who can send MQTT messages to the device to execute arbitrary commands as the root user without any authentication. Although no EPSS score is provided, the absence of authentication and the execution of privileged commands imply a high likelihood of exploitation if an attacker obtains shared IoT credentials. The vulnerability is not listed in CISA KEV, but its severity is inherently high due to the root privilege escalation potential.