Priority LOW 11
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
CVSS 4.0LOW 2.3· Adjacent network · No auth · No interaction · EPSS 0.00226 · Published 2025-09-05 · No fix listed CWE-321
Priority LOW 35
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
CVSS 4.0HIGH 7.5· Network · High privileges · No interaction · EPSS 0.00299 · Published 2025-09-05 · No fix listed CWE-494
Priority LOW 11
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
CVSS 4.0LOW 2.3· Adjacent network · No auth · No interaction · EPSS 0.00141 · Published 2025-09-05 · No fix listed CWE-321
Priority LOW 21
Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
CVSS 4.0MEDIUM 4.7· Physical · No auth · No interaction · EPSS 0.00215 · Published 2025-05-23 · No fix listed CWE-798
Priority MEDIUM 60
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00485 · Published 2025-01-23 · Fixed in 3.0.2, 2024-12-17 CWE-603
Priority MEDIUM 55
ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem.
CVSS 4.0MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00152 · Published 2025-01-23 · No fix listed CWE-312
Priority MEDIUM 57
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages.
CVSS 4.0MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00341 · Published 2025-01-23 · No fix listed CWE-321
Priority HIGH 66
ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number.
CVSS 4.0HIGH 7.0· Physical · No auth · No interaction · EPSS 0.00413 · Published 2025-01-23 · No fix listed CWE-798
Priority HIGH 69
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00223 · Published 2025-01-23 · No fix listed CWE-1391
Priority HIGH 76
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.00352 · Published 2025-01-23 · Fixed in 1.38.0, 1.70.0 +13 CWE-295
Priority HIGH 76
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.00384 · Published 2025-01-23 · Fixed in 3.0.0 CWE-295
Priority MEDIUM 43
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on.
CVSS 4.0LOW 1.8· Local · High privileges · No interaction · EPSS 0.00215 · Published 2025-01-23 · No fix listed CWE-732
Priority LOW 34
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
CVSS 4.0MEDIUM 5.8· Adjacent network · No auth · No interaction · EPSS 0.03127 · Published 2025-01-23 · Fixed in 1.36.187, 1.49.0 +8 CWE-77
THREATIST.IORead the docs