What is GHSA-jf63-2q37-pr75?

GHSA-jf63-2q37-pr75 is a security advisory published by GitHub Security Advisories with Critical severity. FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32...

Which CVE IDs does GHSA-jf63-2q37-pr75 cover?

GHSA-jf63-2q37-pr75 covers the following CVE IDs: CVE-2026-121688. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jf63-2q37-pr75?

GHSA-jf63-2q37-pr75 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-jf63-2q37-pr75CriticalCVSS 9.1

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-121688 →

📋 Description

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-121688
https://github.com/frodobots-org
https://kb.cert.org/vuls/id/188754
https://www.frodobots.ai
https://github.com/advisories/GHSA-jf63-2q37-pr75