PatchTheCVECVE-2019-12820: A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner
CVE-2019-12820 is a medium-severity flaw (CVSS 5.6) affecting i3 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.6 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 59%) |
| CISA exploited list | No |
| Weakness | CWE-319 |
| Published | 2019-07-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-12820?
i3 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-12820 being exploited?
CVE-2019-12820 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-12820 affect?
CVE-2019-12820 affects i3 firmware. Severity is medium (CVSS 5.6). A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an exampl
How urgent is CVE-2019-12820?
Priority 35/100. Remotely exploitable, no login, no user action
Software pages
Android vulnerabilities · iOS vulnerabilities
Related CVEs
- CVE-2026-5841 HIGH 7.3 MITIGATE A weakness has been identified in Tenda i3 1.0.0.6(2204)
- CVE-2026-3971 HIGH 8.8 MITIGATE A vulnerability has been found in Tenda i3 1.0.0.6(2204)
- CVE-2026-3970 HIGH 8.8 MITIGATE A flaw has been found in Tenda i3 1.0.0.6(2204)
- CVE-2026-3804 HIGH 8.8 MITIGATE A security flaw has been discovered in Tenda i3 1.0.0.6(2204)
- CVE-2026-3803 HIGH 8.8 MITIGATE A vulnerability was identified in Tenda i3 1.0.0.6(2204)