{"id":"CVE-2026-121688","aliases":[],"cve":{"records":[{"id":"CVE-2026-121688","source":"certcc","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-03T19:37:24.066Z","published":"2026-11-09T16:25:50.773Z","modified":"2026-11-12T16:55:03.614Z"}],"publishers":[{"name":"certcc","role":"CNA","organizationId":"37e5125f-f79b-445b-8fad-9564f167944b","modified":"2026-11-09T16:25:50.773Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:55:03.614Z"}],"references":[{"url":"https://www.frodobots.ai/","tags":[],"source":"certcc"},{"url":"https://github.com/frodobots-org","tags":[],"source":"certcc"},{"url":"https://kb.cert.org/vuls/id/188754","tags":[],"source":"certcc"}],"weaknesses":[{"id":"CWE-494","description":"CWE-494 Download of Code Without Integrity Check","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:54:54.914760Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism.","titleSource":"certcc","descriptionSource":"certcc","description":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.","score":9.1,"severity":"critical","published":"2026-11-09T16:25:50.773Z","modified":"2026-11-12T16:55:03.614Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"FrodoBots","name":"FrodoBots EarthRover Mini+ firmware","platforms":[],"versions":[{"version":"6.2.4_6.2.5_0.614.0","status":"affected"}],"cpes":[],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-121688"}],"remediation":[],"references":["https://www.frodobots.ai/","https://github.com/frodobots-org","https://kb.cert.org/vuls/id/188754"],"sources":[{"name":"CVE","id":"CVE-2026-121688","modified":"2026-11-12T16:55:03.614Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-121688"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-11-13T05:10:09.998Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:15:35.363Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T17:45:35.617Z","attemptedAt":"2026-11-09T17:45:35.617Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T17:50:32.121Z","attemptedAt":"2026-11-09T17:50:32.121Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T17:50:32.121Z","attemptedAt":"2026-11-09T17:50:32.121Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T17:45:36.665Z","attemptedAt":"2026-11-09T17:45:36.665Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-121688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121688","modified":"2026-11-09T17:17:17.000","checkedAt":"2026-11-09T17:45:35.617Z"},{"source":"ENISA EUVD","id":"EUVD-2026-120093","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120093","modified":"Nov 9, 2026, 4:25:50 PM","checkedAt":"2026-11-09T17:50:32.121Z"}],"aiSummary":{"text":"FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 has an insecure update mechanism, using unencrypted HTTP and MD5 validation, allowing potentially malicious code replacement. The weakness is in the STM32 motor-controller firmware update process. No code-signing mechanism is implemented.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T05:11:05.450Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-121688"}]}}