Multiple severe vulnerabilities exist in the FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0, posing risks of remote code execution and full device compromise. Hard-coded, fleet-wide credentials, including AWS IAM keys and Agora token service details, were found embedded in the firmware, accessible without special privileges. Unauthenticated remote command execution via MQTT allowed arbitrary shell commands to be executed as root, leveraging shared IoT credentials. Several local interfaces, such as an HTTP REST API, ADB root shell, and SSH, were exposed without authentication, granting full local compromise and access to sensitive data like Wi-Fi passwords. An insecure STM32 update mechanism fetched firmware over unencrypted HTTP, validated only by MD5, enabling malicious code injection. Sensitive credentials, including the Wi-Fi PSK and /etc/shadow file, were exposed through insecure storage and unauthenticated access. Furthermore, all processes ran as root, lacking privilege separation, meaning any service compromise granted full administrative control. Exploitation could lead to unauthorized access to live camera and microphone feeds, fleet-wide remote root access, Wi-Fi credential extraction, and persistent compromise. The vendor has addressed many issues, removing most hard-coded credentials and arbitrary shell command execution. Local interface vulnerabilities are considered mitigated as they require physical proximity and Wi-Fi connection. Users are strongly advised to update their EarthRover Mini+ firmware to the latest version.