CVE-2025-2394mediumCWE-798

CVE-2025-2394: medium-severity vulnerability in Ecovacs Mobile and Android Application

Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications

Published · Updated

Follow this CVE+ Monitor Ecovacs Mobile and Android Application

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.2%
Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Affected products
Ecovacs · Ecovacs Mobile and Android Application