Description (CNA)
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ECOVACS / DEEBOT X5 PRO PLUS | unaffected 1.38.0; affected 0 before 1.38.0 |
| ECOVACS / DEEBOT X5 PRO | unaffected 1.70.0; affected 0 before 1.70.0 |
| ECOVACS / DEEBOT X2S | affected 0 before 1.49.0; unaffected 1.49.0 |
| ECOVACS / DEEBOT X2 OMNI | unaffected 1.76.6; affected 0 before 1.76.6 |
| ECOVACS / DEEBOT X1 TURBO | affected 0 before 2.4.41; unaffected 2.4.41 |
| ECOVACS / DEEBOT X1 | unaffected 1.7.3; affected 0 before 1.7.3 |
| ECOVACS / DEEBOT X1S PRO | unaffected 2.5.31; affected 0 before 2.5.31 |
| ECOVACS / DEEBOT X1e OMNI | unaffected 2.4.42; affected 0 before 2.4.42 |
| ECOVACS / DEEBOT T10 PLUS | unaffected 1.7.5; affected 0 before 1.7.5 |
| ECOVACS / DEEBOT T10 OMNI | affected 0 before 1.9.0; unaffected 1.9.0 |
| ECOVACS / DEEBOT X5 PRO ULTRA | affected 0 before 1.17.0; unaffected 1.17.0 |
| ECOVACS / Mate X | unaffected 1.44.18; affected 0 before 1.44.18 |
| ECOVACS / DEEBOT X2 PRO | unaffected 1.76.6; affected 0 before 1.76.6 |
| ECOVACS / DEEBOT X2 COMBO | affected 0 before 1.81.10; unaffected 1.81.10 |
| ECOVACS / DEEBOT X1 OMNI | affected 0 before 2.4.41; unaffected 2.4.41 |
| ECOVACS / DEEBOT X1 PRO OMNI | unaffected 2.4.41; affected 0 before 2.4.41 |
| ECOVACS / DEEBOT X1 PLUS | unaffected 1.7.3; affected 0 before 1.7.3 |
| ECOVACS / DEEBOT X1S PRO PLUS | unaffected 1.23.0; affected 0 before 1.23.0 |
| ECOVACS / DEEBOT T10 TURBO | unaffected 1.10.0; affected 0 before 1.10.0 |
| ECOVACS / DEEBOT T10 | affected 0 before 1.7.5; unaffected 1.7.5 |
CWE
CWE-295
References
- https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
- https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
- https://www.ecovacs.com/global/userhelp/dsa20241217001
ADP enrichment
No English description supplied.
No references supplied.