Description
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FrodoBots | FrodoBots EarthRover Mini+ firmware | 6.2.4_6.2.5_0.614.0 | — |