{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121685","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","state":"PUBLISHED","assignerShortName":"certcc","dateReserved":"2026-11-03T19:36:53.606Z","datePublished":"2026-11-09T16:23:05.993Z","dateUpdated":"2026-11-09T16:23:05.993Z"},"containers":{"cna":{"title":"CVE-2026-121685","descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges."}],"source":{"discovery":"UNKNOWN"},"affected":[{"vendor":"FrodoBots","product":"FrodoBots EarthRover Mini+ firmware","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-798 Use of Hard-coded Credentials"}]}],"references":[{"url":"https://www.frodobots.ai/"},{"url":"https://github.com/frodobots-org"},{"url":"https://kb.cert.org/vuls/id/188754"}],"x_generator":{"engine":"VINCE 4.0.2","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-121685"},"providerMetadata":{"orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc","dateUpdated":"2026-11-09T16:23:05.993Z"}}}}