ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.5epss 0.3%
exploitation probability
0.3%top 72% of all CVEs
observed exploitation
nono source reports it
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Affected products
ECOVACS · DEEBOT T10ECOVACS · DEEBOT T10 OMNIECOVACS · DEEBOT T10 PLUSECOVACS · DEEBOT T10 TURBOECOVACS · DEEBOT X1ECOVACS · DEEBOT X1e OMNIECOVACS · DEEBOT X1 OMNIECOVACS · DEEBOT X1 PLUSECOVACS · DEEBOT X1 PRO OMNIECOVACS · DEEBOT X1S PROECOVACS · DEEBOT X1S PRO PLUSECOVACS · DEEBOT X1 TURBOECOVACS · DEEBOT X2 COMBOECOVACS · DEEBOT X2 OMNIECOVACS · DEEBOT X2 PROECOVACS · DEEBOT X2SECOVACS · DEEBOT X5 PROECOVACS · DEEBOT X5 PRO PLUSECOVACS · DEEBOT X5 PRO ULTRAECOVACS · Mate X