VDB
CVE-2026-121688
CVE-2026-121688
PUBLISHED
Reported by certcc · Published November 9, 2026
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
EPSS 0.12% · 1.6th percentile
Risk scores
EPSS Score
0.12%
1.6th percentile
Affected products
| Vendor | Product | Versions |
|---|---|---|
| FrodoBots | FrodoBots EarthRover Mini+ firmware | 6.2.4_6.2.5_0.614.0 |
| FrodoBots | FrodoBots EarthRover Mini+ firmware | 6.2.4_6.2.5_0.614.0 |
Timeline
- Nov 9, 2026 Coalition ESS Score
- Nov 9, 2026 CVE Published
- Nov 9, 2026 PoC Published
- Nov 9, 2026 CVE Updated
- Nov 10, 2026 EPSS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-121688
vulnetix vdb fixes CVE-2026-121688Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-121688/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart