Description (CNA)
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ECOVACS / ECOVACS HOME | unaffected 3.0.0; affected 0 before 3.0.0 |
CWE
CWE-295
References
- https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
- https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
- https://www.ecovacs.com/global/userhelp/dsa20241217001
ADP enrichment
No English description supplied.
No references supplied.