CVE-2026-121688 CVE-2026-121688

Critical 9.1 Published 9 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-121688?

CVE-2026-121688 is a critical vulnerability in FrodoBots EarthRover Mini+ firmware, published on 9 Nov 2026.

Official description

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

Weakness: CWE-494

Which versions are affected by CVE-2026-121688?

How do I fix CVE-2026-121688?

No fix has been published for CVE-2026-121688 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-121688 being exploited?

There is no known exploitation of CVE-2026-121688 in the wild and no public exploit code.

Sources

Also known as GHSA-jf63-2q37-pr75.