Vulnerabilities

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem.

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages.

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number.

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates.

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates.

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on.