CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...

ECOVACS lawnmower and vacuum vulnerabilities

RISK EVALUATION ECOVACS lawnmowers, vacuums, and other robots contain multiple vulnerabilities. In some cases, using a combination of vulnerabilities, an attacker within Bluetooth range or with appropriate network access can take complete control of a robot device. Some vulnerabilities allow an...

PT-2025-2929

Name of the Vulnerable Software and Affected Versions ECOVACS robot lawnmowers and vacuums affected versions not specified Description The issue concerns the use of a deterministic symmetric key for decrypting firmware updates in ECOVACS robots. This allows an attacker to create and encrypt...

ECOVACS robot lawnmowers和vacuums 信任管理问题漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. A security vulnerability exists in ECOVACS lawnmowers and vacuums, which stems from improper...

PT-2025-2928 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS lawnmowers and vacuums affected versions not specified Description: The issue concerns the improper validation of TLS certificates by ECOVACS lawnmowers and vacuums. This allows an unauthenticated attacker to read or modify TLS traffi...

CVE-2024-52331: Download of Code Without Integrity Check

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...

PT-2025-1744 · Ecovacs · Ecovacs Vacuums +1

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawn mowers and vacuums affected versions not specified Description: The issue concerns the use of a shared, static secret key to encrypt BLE GATT messages in ECOVACS robots. This allows an unauthenticated attacker within BLE...

PT-2025-2926 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the insecure storage of audio files used to indicate when the camera is on in ECOVACS robots. An attacker with access to the /data filesystem...

ECOVACS robot lawnmowers和vacuums 安全漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. The ECOVACS robot lawnmowers and vacuums suffer from a security vulnerability that stems from...

PT-2025-2924 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns command injection via the SetNetPin function over an unauthenticated Bluetooth Low Energy BLE connection. This allows for potential...

ECOVACS robot lawnmowers和vacuums 命令注入漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. A security vulnerability exists in the ECOVACS robot lawnmowers and vacuums that stems from a...

CVE-2024-11147: Use of Hard-coded Credentials

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

ECOVACS robot lawnmowers和vacuums 信任管理问题漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. A security vulnerability exists in the ECOVACS robot lawnmowers and vacuums that stems from th...

CVE-2024-12078: Use of Hard-coded Cryptographic Key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-12079: Cleartext Storage of Sensitive Information

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-52327: Use of Client-Side Authentication

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

ECOVACS HOME mobile app plugins 信任管理问题漏洞

The ECOVACS HOME mobile app plugins is a mobile app plugin from ECOVACS, China. A security vulnerability exists in the ECOVACS HOME mobile app plugins that stems from the mobile app plugin not properly validating TLS certificates. An unauthenticated attacker could read or modify TLS traffic and...

PT-2025-2925 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS affected versions not specified Description: The issue allows authenticated attackers to bypass the PIN entry required to access the live video feed. This affects the cloud service used by ECOVACS robot lawnmowers and vacuums...

CVE-2024-52329: Improper Certificate Validation

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens...

PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An...