The vulnerability resides in the STM32 firmware update mechanism of FrodoBots EarthRover Mini+, where updates are fetched over plain HTTP and only validated with an MD5 hash supplied in the same unprotected response. This lack of authentication, encryption, and code‑signing allows an attacker to replace the motor controller firmware with malicious code, effectively granting full control over the device’s functionality and potentially its data. The weakness is classified as an improper verification of cryptographic signatures and improper integrity checking.

Affected products include FrodoBots EarthRover Mini+ firmware. The vulnerability affects the firmware versions 6.2.4, 6.2.5, and 0.614.0 as distributed by FrodoBots.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV. While no specific exploitation statistics are provided, the mechanism's design—unencrypted HTTP delivery, weak MD5 hash, and no code‑signing—confers a high potential for exploitation. The attack vector is inferred to be remote if the HTTP update endpoint is reachable from outside the local network, or local if the device accepts firmware updates from devices on the same network. In either case, an attacker could replace firmware, leading to arbitrary code execution on the device.