Quick answers
- Is CVE-2026-121686 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121686 being exploited in the wild.
- How severe is CVE-2026-121686?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- FrodoBots EarthRover Mini+ 6.2.4_6.2.5_0.614.0.
- Is there a fix for CVE-2026-121686?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121686 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-121686?
- Check whether you run FrodoBots EarthRover Mini+ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-121686 is an unauthenticated remote code execution vulnerability in the firmware's MQTT message handler. A firmware method accepts arbitrary shell commands delivered via AWS IoT MQTT messages and executes them with root privileges. Access is gated only by hard-coded, fleet-wide IoT credentials embedded in the firmware (disclosed in CVE-2026-121685), not per-device authentication, enabling RCE as root across all affected devices without individual device authorization.
Affected products
- FrodoBots EarthRover Mini+ 6.2.4_6.2.5_0.614.0
Timeline
- 2026-11-09: disclosed