CVE-2024-12078: Use of Hard-coded Cryptographic Key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key...

PT-2025-1744 · Ecovacs · Ecovacs Vacuums +1

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawn mowers and vacuums affected versions not specified Description: The issue concerns the use of a shared, static secret key to encrypt BLE GATT messages in ECOVACS robots. This allows an unauthenticated attacker within BLE...