EUVD-2024-46257

Malicious code in bioql PyPI...

EUVD-2024-46255

Malicious code in bioql PyPI...

CVE-2025-30198

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived...

CVE-2025-30200: Use of Hard-coded Cryptographic Key

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived...

CVE-2024-12079

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-52325

ECOVACS robot lawnmowers and vacuums are affected by a vulnerability described as command injection via SetNetPin() over an unauthenticated Bluetooth Low Energy (BLE) connection. Public sources consistently identify the vulnerable component as the SetNetPin() function, with exploitation possible ...

CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...

CVE-2024-52331: Download of Code Without Integrity Check

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...

CVE-2024-12079: Cleartext Storage of Sensitive Information

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

CVE-2024-11147: Use of Hard-coded Credentials

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

CVE-2024-12078: Use of Hard-coded Cryptographic Key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

CVE-2024-52325: Improper Neutralization of Special Elements used in a Command

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...

CVE-2024-52328: Incorrect Permission Assignment for Critical Resource

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on...

CVE-2024-52327: Use of Client-Side Authentication

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...