Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2024-52331

ECOVACS lawnmowers and vacuums deterministic firmware encryption key

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-52330

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Deebot T10 Deebot T10 Firmware Deebot T10 Omni and 37 more
CVE-2024-12079

ECOVACS lawnmowers cleartext storage of anti-theft PIN

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-12078

ECOVACS lawnmowers and vacuums static BLE GATT encryption key

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-52328

ECOVACS lawnmowers and vacuums insecurely store audio warning files

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-11147

ECOVACS lawnmowers and vacuums deterministic root password

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Airbot Andy Airbot Andy Firmware Airbot Ava and 25 more
CVE-2024-52327

ECOVACS lawnmower and vacuum cloud service live video PIN bypass

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Home
CVE-2024-52329

ECOVACS HOME mobile app plugins do not properly validate TLS certificates

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Home
CVE-2025-30200

ECOVACS Vacuum and Base Station Hard-Coded AES Encryption

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Deebot T10 Deebot T10 Firmware Deebot T10 Omni and 23 more
CVE-2025-30199

ECOVACS Vacuum and Base Station accept unsigned firmware

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs
Products
Deebot T10 Deebot T10 Firmware Deebot T10 Omni and 23 more