Ecovacs
13 CVEs across 115 Ecovacs products. Browse Ecovacs vulnerabilities, severities, and proof-of-concept exploits.
Ecovacs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30199 | High | 7.2 | 2025-09-05 | ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection betw… |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-2394 | | 2025-05-23 | Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadi… | |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-52330 | High | 7.4 | 2025-01-23 | ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmwa… |
CVE-2024-52329 | High | 7.4 | 2025-01-23 | ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and o… |
CVE-2024-52328 | Low | 2.3 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can d… |
CVE-2024-52327 | Medium | 6.5 | 2025-01-23 | The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed. |
CVE-2024-12079 | Low | 3.3 | 2025-01-23 | ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-th… |
CVE-2024-12078 | Medium | 6.3 | 2025-01-23 | ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control an… |
CVE-2024-11147 | High | 7.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as r… |
CVE-2024-52325 | Critical | 9.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. |