CVE-2024-52327

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-12078

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-52327

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-11147

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-52327

CVE-2024-52327 affects ECOVACS cloud service for robot lawnmowers/vacuums; authenticated attackers can bypass PIN to access live video feed. Documented in multiple feeds with CVSS metrics (AV:N/AC:L/PR:L/UI:N/S:U for CVSS 3.1, and related CS metrics). The connected sources confirm the vulnerabili...

CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-12079 ECOVACS lawnmowers cleartext storage of anti-theft PIN

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-12079 ECOVACS lawnmowers cleartext storage of anti-theft PIN

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-12079

ECOVACS robot lawnmowers are affected by CVE-2024-12079 due to storing the anti-theft PIN in cleartext on the device filesystem. This allows a local attacker to read the PIN and reset the anti-theft mechanism, enabling theft or circumvention of anti-theft protections. The available sources confir...

CVE-2024-12078

ECOVACS robot lawn mowers and vacuums are affected by CVE-2024-12078 due to a shared static secret key used to encrypt BLE GATT messages. An unauthenticated attacker in BLE range can control any ECOVACS device using the same key. The issue is described across multiple sources, confirming the vuln...

CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-11147

CVE-2024-11147 affects ECOVACS robot lawnmowers and vacuums. A deterministic root password generated from the model and serial number allows an attacker with shell access to login as root. Provided documents identify the affected product scope and root-password mechanism, but do not specify patch...

CVE-2024-11147 ECOVACS lawnmowers and vacuums deterministic root password

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

CVE-2024-11147 ECOVACS lawnmowers and vacuums deterministic root password

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

CVE-2024-52331 ECOVACS lawnmowers and vacuums deterministic firmware encryption key

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...

CVE-2024-52331 ECOVACS lawnmowers and vacuums deterministic firmware encryption key

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...

CVE-2024-52331

ECOVACS robot lawnmowers and vacuums are affected by CVE-2024-52331 due to a deterministic symmetric key used to decrypt firmware updates. This allows an attacker to create and encrypt malicious firmware that will be decrypted and installed by the device. The description and connected entries con...

CVE-2024-52330 ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates...