{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121687","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","state":"PUBLISHED","assignerShortName":"certcc","dateReserved":"2026-11-03T19:37:12.923Z","datePublished":"2026-11-09T16:25:00.570Z","dateUpdated":"2026-11-09T16:25:00.570Z"},"containers":{"cna":{"title":"CVE-2026-121687","descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)"}],"source":{"discovery":"UNKNOWN"},"affected":[{"vendor":"FrodoBots","product":"FrodoBots EarthRover Mini+ firmware","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-306 Missing Authentication for Critical Function"}]}],"references":[{"url":"https://www.frodobots.ai/"},{"url":"https://github.com/frodobots-org"},{"url":"https://kb.cert.org/vuls/id/188754"}],"x_generator":{"engine":"VINCE 4.0.2","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-121687"},"providerMetadata":{"orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc","dateUpdated":"2026-11-09T16:25:00.570Z"}}}}