CVE-2024-52327: medium-severity vulnerability in ECOVACS cloud service
ECOVACS lawnmower and vacuum cloud service live video PIN bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ECOVACS robot lawnmowers and vacuums have a security flaw that lets someone who is already logged into the cloud service skip the PIN protection and watch the live video feed. This is a problem because the PIN was meant to be an extra security layer to keep your home's video private.
Authenticated attackers can bypass PIN verification (CWE-603: Use of Hard-Coded Password) on the ECOVACS cloud service to access live video feeds from connected devices. The vulnerability requires prior authentication to the cloud account (CWE-807: Reliance on Hard-Coded IP Address) but circumvents an additional authorization control, potentially exposing unauthorized surveillance capabilities.
In the same product, most dangerous first.