News, updates, trends and the latest
info you need to know about IT

Overview
Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network.
Description
The FrodoBots EarthRover Mini+ is a compact, internet‑connected mobile robot used in educational and consumer environments. The device includes a camera, microphone, motor controllers, and multiple onboard services. Multiple vulnerabilities in the EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) can allow remote code execution, unauthorized access to onboard sensors, exposure of sensitive data, and complete device compromise. An attacker could potentially take remote control of the rover, access its audio and video streams, or use it to gain a foothold in its network.
CVE-2026-121685: The firmware contains several sets of hard-coded, fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM (Amazon Web Services Identity and Access Management) access keys, Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) credentials, and a Slack incoming webhook URL. Agora Token Service is an open source server that generates secure, time‑limited authentication tokens for use with Agora.io’s RTC (Real‑Time Communication) and RTM (Real‑Time Messaging) services. A Slack incoming webhook URL is a unique endpoint that lets external systems send messages into a Slack channel without the need for a full Slack application. These are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware or from any device. Extraction requires no special privileges.
CVE-2026-121686: Unauthenticated remote command execution is allowed via Message Queuing Telemetry Transport (MQTT). A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution (RCE) as root across the fleet. The IoT credentials are hard-coded in the firmware as discussed in CVE-2026-121685.
CVE-2026-121687: Several local interfaces are exposed without authentication. These services allow full local compromise of device functionality and provide access to sensitive information.
* HTTP REST API on port 80 (motor control, telemetry/GPS/IMEI) contains endpoints that reveal the plaintext Wi‑Fi password, enable Wi‑Fi join functionality, diagnostic export services
* Android Debug Bridge (ADB) root shell on port 5555
* SSH on port 22
CVE-2026-121688: The firmware contains an insecure STM32 update mechanism. STM32 is a family of 32-bit microcontrollers and is based primarily on Arm Cortex-M processor cores. They are widely used in embedded systems, IoT devices, industrial controls, robotics, automotive electronics, and consumer products. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.
CVE-2026-121689: The firmware exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file.
CVE-2026-121690: The firmware executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device.
Impact
Exploitation of these vulnerabilities may allow:
* Unauthorized access to live camera and microphone feeds.
* Fleet‑wide remote root access and full robot control via MQTT.
* Extraction of the user’s Wi‑Fi credentials and lateral movement onto the local network.
* Persistent compromise through tampered motor‑controller firmware.
* Unauthorized posting to the vendor’s Slack channels and potential exposure of backend infrastructure via IAM credential misuse.
* Given the rover’s mobility and sensor suite, exploitation may enable both digital and physical impacts.
Solution
As of this writing, the vendor has provided the following remediation status:
CVE-2026-121685 (Hard-coded credentials): Addressed
Most embedded credentials have been removed. One credential remains for requesting an Agora session token; backend authorization checks restrict misuse. Remaining credentials are limited to session‑bound operations.
CVE-2026-121686 (Remote command execution): Addressed
Arbitrary shell command execution has been removed. The device now supports only a small set of predefined management commands (e.g., reboot).
CVE-2026-121687 — CVE-2026-121690. (Local interfaces and privilege model): Addressed or not remotely exploitable under current deployment model.
Local interfaces require connection to the device’s Wi‑Fi access point, which has a configurable password. The vendor asserts that an attacker must be physically near the device and connected to its Wi‑Fi network to exploit these interfaces. The firmware update process is manual and conducted through the local Wi‑Fi network.
The vendor validated changes via static analysis and internal implementation review, and considers the findings fixed, mitigated, or not applicable in the current deployment model.
Users are encouraged to update to the latest version of the FrodoBots EarthRover Mini+ firmware.
Acknowledgements
Thank you to Justin Davis for reporting these vulnerabilities. This document was written by Bob Kemerer.

Overview
PrestaShop’s back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process.
Description
PrestaShop is an open-source e-commerce platform for creating and managing online stores. Its back-office Performance configuration includes a Debug mode for developers, which is enabled based on a specified cookie name and value.
PrestaShop’s debug-mode configuration code inserts the user-controlled values debug_cookie_name and debug_cookie_value into a PHP expression without adequately escaping or sanitizing them for use in PHP source code. The application writes this expression into the PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php. A crafted value can terminate the intended string and introduce attacker-controlled PHP statements. The modified configuration file is loaded during application initialization, causing the injected code to execute on a subsequent request.
Exploitation requires an authenticated back-office account with permission to modify debug mode settings and a configuration file writable by the PHP process. Root or operating-system administrator privileges are not required. Cross-site request forgery (CSRF) protection helps prevent unauthorized requests made through another user’s session, but does not prevent exploitation by an attacker controlling an account with the required permissions. Injected code executes with the privileges of the PHP process. Affected release versions remain to be confirmed.
Impact
An authenticated attacker with the required configuration permissions could execute arbitrary PHP code in the security context of the PHP process. This could allow access to application secrets and customer data, modification or deletion of application files and database contents, and disruption of store operations. Operating-system command execution depends on the PHP configuration and available functions. The vulnerability does not independently grant root privileges.
Solution
PrestaShop version 9.2.1 addresses this vulnerability. Administrators should upgrade affected installations to version 9.2.1 or later.
If an immediate upgrade is not possible, allow only trusted administrators to modify Performance and Debug mode settings, and restrict network access to the back office. Where operationally feasible, prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php. This may also prevent legitimate configuration changes.
Acknowledgements
Thanks to Deflask13 for reporting this vulnerability. This document was written by Michael Bragg.

Overview
Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity.
Description
BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application.
VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks.
VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata.
VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous.
Impact
Impacts of successful exploitation vary by vulnerability.
VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft.
VU#124705.2: An attacker can locate the public RevenueCat SDK key and query the RevenueCat API using arbitrary phone numbers to retrieve associated user metadata, including activity and purchase history.
VU#124705.3: The personal data, or PII, of other users, intended to be anonymous, can be accessed through local system logs. The application’s backend sending other users’ MSISDNs to the client in any capacity presents a privacy violation.
These vulnerabilities have been confirmed against Basechat – Audio Dating App, Android version 9.8.1.
Solution
Unfortunately, Mobile Trading GmbH, the owners of BaseChat, could not be reached to coordinate this vulnerability.
Acknowledgements
Thanks to Mahmoud Ali Khan for reporting these vulnerabilities. This document was written by Alex Lewis.