← back
CVE-2024-52325

ECOVACS robot lawnmowers and vacuums command injection

CVSS 5.8 MEDIUMEPSS 3.0%CWE-77
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Affected products
ECOVACS · DEEBOT T30 OMNIECOVACS · DEEBOT T30SECOVACS · DEEBOT X2 COMBOECOVACS · DEEBOT X2 OMNIECOVACS · DEEBOT X2SECOVACS · DEEBOT X5 PROECOVACS · DEEBOT X5 PRO PLUSECOVACS · DEEBOT X5 PRO ULTRAECOVACS · GOAT G1ECOVACS · GOAT G1-2000ECOVACS · GOAT G1-800ECOVACS · GOAT GX-600

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdfhttps://www.ecovacs.com/global/userhelp/dsa20241119https://www.ecovacs.com/global/userhelp/dsa20241130001https://youtu.be/_wUsM0Mlenc?t=2041