Ecovacs Deebot X1 Omni Firmware
4 CVEs affecting Ecovacs Deebot X1 Omni Firmware. Latest disclosed: 2025-09-05. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52330 | High | 7.4 | 2025-01-23 | ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmwa… |
CVE-2025-30199 | High | 7.2 | 2025-09-05 | ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection betw… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |