ECOVACS lawnmower and vacuum cloud service live video PIN bypass
No sign of exploitation. No public exploitation artifact known so far.
ECOVACS robot lawnmowers and vacuums have a security flaw that lets someone who is already logged into the cloud service skip the PIN protection and watch the live video feed. This is a problem because the PIN was meant to be an extra security layer to keep your home's video private.
Authenticated attackers can bypass PIN verification (CWE-603: Use of Hard-Coded Password) on the ECOVACS cloud service to access live video feeds from connected devices. The vulnerability requires prior authentication to the cloud account (CWE-807: Reliance on Hard-Coded IP Address) but circumvents an additional authorization control, potentially exposing unauthorized surveillance capabilities.