Read the docs

ECOVACS

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

ECOVACS records in CISA KEV

No ECOVACS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Deebot T10 Firmware 9 records HIGH Deebot X1 Firmware 6 records HIGH Goat G1 Firmware 6 records HIGH Airbot Andy Firmware 5 records HIGH Airbot Ava Firmware 5 records HIGH Airbot Z1 Firmware 5 records HIGH Deebot 900 Firmware 5 records HIGH Deebot N10 Firmware 5 records HIGH

Records

13 records

TI-2024-10331 CVE-2024-11147 · GHSA-w3jw-m3f7-54qm

ECOVACS lawnmowers and vacuums deterministic root password

Priority HIGH 66

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number.

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00413 Published 2025-01-23 No fix listed CWE-798
TI-2024-34999 CVE-2024-52327 · GHSA-wxx6-j873-v2qh

ECOVACS lawnmower and vacuum cloud service live video PIN bypass

Priority MEDIUM 60

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00485 Published 2025-01-23 Fixed in 3.0.2, 2024-12-17 CWE-603
TI-2024-11205 CVE-2024-12079 · GHSA-qrcf-c92m-949r

ECOVACS lawnmowers cleartext storage of anti-theft PIN

Priority MEDIUM 55

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00152 Published 2025-01-23 No fix listed CWE-312
TI-2025-21535 CVE-2025-30199 · GHSA-2hqv-x23m-4c88

ECOVACS Vacuum and Base Station accept unsigned firmware

Priority LOW 35

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00299 Published 2025-09-05 No fix listed CWE-494
TI-2024-34998 CVE-2024-52325 · GHSA-wgmc-5v7x-58m5

ECOVACS robot lawnmowers and vacuums command injection

Priority LOW 34

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

CVSS 4.0MEDIUM 5.8 Adjacent network No auth No interaction EPSS 0.03127 Published 2025-01-23 Fixed in 1.36.187, 1.49.0 +8 CWE-77
TI-2025-21536 CVE-2025-30200 · GHSA-4xjv-rh5p-qv86

ECOVACS Vacuum and Base Station Hard-Coded AES Encryption

Priority LOW 11

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00141 Published 2025-09-05 No fix listed CWE-321
TI-2025-21534 CVE-2025-30198 · GHSA-2hh7-5899-hfpg

ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK

Priority LOW 11

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00226 Published 2025-09-05 No fix listed CWE-321
Open these records in search →