CVE-2026-121685

Shared rover credentials could expose media sessions

CERT/CC and FrodoBots · EarthRover Mini+ media and data collection

First documented disclosure · Review checkpoint

Summary

The tested firmware contained shared service credentials, including one tied to the EarthRover media service. Earth Rovers are used to collect navigation research data.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The researcher tested an owned rover. FrodoBots reports no indication that its infrastructure or a third-party device was accessed.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Credentials embedded in distributed firmware were not all limited to the device that held them.

Conditions required

An attacker obtains a copy of the affected firmware. Access depends on which backend credentials are still valid and their scope.

Potential impact

The original credentials could expose services associated with the rover, including live audio and video. The public record establishes no training-dataset compromise.

Affected versions and configurations

EarthRover Mini+ firmware 6.2.4_6.2.5_0.614.0, the build examined by the researcher.

Fix and mitigation status

CERT/CC names no verified fixed firmware build. FrodoBots describes service-side mitigations and a progressive device update.

Practical next steps

Update to the latest vendor firmware. FrodoBots reports revoking cloud credentials and scoping remaining media-session access on the backend.

Operating lesson

Issue revocable per-device credentials for research fleets. Do not embed fleet-wide access in distributed images.

Evidence and limits

The vendor says testing used the researcher’s own rover and reports no evidence of access to third-party devices or vendor infrastructure. Its verification was by static analysis and internal review.

Sources