CVE-2024-0259

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to ga...

CVE-2024-12079

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-52327

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-12078

ECOVACS robot lawn mowers and vacuums are affected by CVE-2024-12078 due to a shared static secret key used to encrypt BLE GATT messages. An unauthenticated attacker in BLE range can control any ECOVACS device using the same key. The issue is described across multiple sources, confirming the vuln...

CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...

CVE-2024-52325

ECOVACS robot lawnmowers and vacuums are affected by a vulnerability described as command injection via SetNetPin() over an unauthenticated Bluetooth Low Energy (BLE) connection. Public sources consistently identify the vulnerable component as the SetNetPin() function, with exploitation possible ...

ECOVACS lawnmower and vacuum vulnerabilities

RISK EVALUATION ECOVACS lawnmowers, vacuums, and other robots contain multiple vulnerabilities. In some cases, using a combination of vulnerabilities, an attacker within Bluetooth range or with appropriate network access can take complete control of a robot device. Some vulnerabilities allow an...

PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An...

PT-2025-2924 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns command injection via the SetNetPin function over an unauthenticated Bluetooth Low Energy BLE connection. This allows for potential...

ECOVACS robot lawnmowers和vacuums 安全漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. The ECOVACS robot lawnmowers and vacuums suffer from a security vulnerability that stems from ...

ECOVACS robot lawnmowers 安全漏洞

ECOVACS robot lawnmowers is a series of lawnmowers from the Chinese company ECOVACS. A security vulnerability exists in ECOVACS robot lawnmowers that originates from storing the anti-theft PIN in plaintext in the device file system. An attacker could steal the lawnmower, read the PIN, and reset t...

CVE-2025-22582

Cross-Site Request Forgery CSRF vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through = 0.1.3...

CVE-2025-22582 WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Scott Nellé Uptime Robot allows Stored XSS.This issue affects Uptime Robot: from n/a through 0.1.3...

CVE-2025-22582

CVE-2025-22582 is a CSRF-to-Stored-XSS vulnerability in the Uptime Robot WordPress plugin (Scott Nellé) affecting versions from n/a up to 0.1.3. The Connected Red Hat doc reiterates the CSRF/Stored XSS description; no exploitation details are provided. CVSS v3.1 base score is 7.1 (HIGH). No patch...

CVE-2025-22582 WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through = 0.1.3...

WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Uptime Robot versions = 0.1.3...

PT-2025-4570 · Unknown · Uptime Robot

Name of the Vulnerable Software and Affected Versions: Uptime Robot versions 0.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and als...

WordPress plugin Uptime Robot 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

Delta Electronics DRASimuCAD Type Obfuscation Vulnerability

Delta Electronics DRASimuCAD is an integrated platform for robot simulation. A type confusion vulnerability exists in Delta Electronics DRASimuCAD, which can be exploited by an attacker to execute arbitrary code in the context of the current process...