PatchTheCVEdeebot 900 firmware vulnerabilities and fixes
Recent CVEs affecting deebot 900 firmware, with upgrade or downgrade steps. 4 tracked.
Also searched as: deebot900firmware.
deebot 900 firmware has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-01-23. Highest priority: CVE-2024-11147 (score 40/100).
- CVE-2024-52331 HIGH 7.5 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates
- CVE-2024-52328 LOW 2.3 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on
- CVE-2024-12079 LOW 3.3 MITIGATE MITIGATE ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem
- CVE-2024-11147 HIGH 7.6 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial num
FAQ
How do I fix deebot 900 firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is deebot 900 firmware being exploited right now?
None of the tracked deebot 900 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which deebot 900 firmware CVE should I patch first?
CVE-2024-11147 currently ranks highest (40/100): ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial num.