Description
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
Published: 2026-11-09
Score: n/a
EPSS: n/a
KEV: No
Impact: Credential Exposure
Action: Apply Patch
AI Analysis

Impact

The firmware stores Wi‑Fi pre‑shared keys in plaintext in the configuration file and discloses them through unauthenticated API endpoints and diagnostic exports. In addition, an unauthenticated ADB interface allows retrieval of the entire /etc/shadow file. An attacker who can reach the device or its network can therefore obtain Wi‑Fi credentials and potentially user password hashes, enabling further compromise of the device and any connected infrastructure.

Affected Systems

FrodoBots, EarthRover Mini+ firmware, versions v6.2.4_6.2.5_0.614.0

Risk and Exploitability

The vulnerability is not reported in the CISA KEV catalog and its EPSS score is not available, yet the lack of authentication on API and ADB access makes exploitation straightforward for anyone with network proximity. The resulting compromise of wireless credentials and password hashes poses a significant threat to confidentiality and network integrity.

Generated by OpenCVE AI on November 9, 2026 at 17:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update that encrypts stored credentials and requires authentication for API and ADB access
  • Reconfigure or remove the plaintext wpa_supplicant.conf file, storing Wi‑Fi settings securely
  • Disable or restrict ADB access unless explicitly needed, ensuring it requires authentication
  • Segment the device network to limit exposure to untrusted hosts

Generated by OpenCVE AI on November 9, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
CWE-311
CWE-522

Mon, 09 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Description FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
Title CVE-2026-121689
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-11-09T16:27:03.106Z

Reserved: 2026-11-03T19:37:38.749Z

Link: CVE-2026-121689

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T17:17:17.120

Modified: 2026-11-09T17:17:17.120

Link: CVE-2026-121689

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T17:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

  • CWE-311

    Missing Encryption of Sensitive Data

  • CWE-522

    Insufficiently Protected Credentials