CVE-2024-52327

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

CVE-2024-52325: Improper Neutralization of Special Elements used in a Command

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin over an unauthenticated BLE connection...

CVE-2024-52327: Use of Client-Side Authentication

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed...

PT-2025-2924 · Ecovacs · Ecovacs

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns command injection via the SetNetPin function over an unauthenticated Bluetooth Low Energy BLE connection. This allows for potential...

CVE-2024-12079: Cleartext Storage of Sensitive Information

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism...

ECOVACS robot lawnmowers和vacuums 安全漏洞

ECOVACS robot vacuums and ECOVACS robot lawnmowers are both products of the Chinese company ECOVACS.ECOVACS robot vacuums are a line of vacuum cleaners.ECOVACS robot lawnmowers are a line of lawnmowers. The ECOVACS robot lawnmowers and vacuums suffer from a security vulnerability that stems from ...

ECOVACS robot lawnmowers 安全漏洞

ECOVACS robot lawnmowers is a series of lawnmowers from the Chinese company ECOVACS. A security vulnerability exists in ECOVACS robot lawnmowers that originates from storing the anti-theft PIN in plaintext in the device file system. An attacker could steal the lawnmower, read the PIN, and reset t...

CVE-2024-11147: Use of Hard-coded Credentials

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An...

CVE-2024-52328: Incorrect Permission Assignment for Critical Resource

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on...

CVE-2024-52331: Download of Code Without Integrity Check

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot...