ecovacs vulnerabilities

Recent CVEs affecting ecovacs products. 12 tracked.

ecovacs has 12 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-09-05. Highest priority: CVE-2024-52325 (score 60/100).

CVE-2025-30199 HIGH 7.2 UPGRADE UPGRADE ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be
CVE-2025-30198 MEDIUM 6.3 UPGRADE UPGRADE ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PS
CVE-2025-30200 MEDIUM 6.3 UPGRADE UPGRADE ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES enc
CVE-2024-52331 HIGH 7.5 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates
CVE-2024-52330 HIGH 7.4 UPGRADE UPGRADE ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
CVE-2024-52329 HIGH 7.4 UPGRADE UPGRADE ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates
CVE-2024-52328 LOW 2.3 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on
CVE-2024-52327 MEDIUM 6.5 UPGRADE UPGRADE The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PI
CVE-2024-52325 CRITICAL 9.6 UPGRADE UPGRADE ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticat
CVE-2024-12079 LOW 3.3 MITIGATE MITIGATE ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem
CVE-2024-12078 MEDIUM 6.3 MITIGATE MITIGATE ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages
CVE-2024-11147 HIGH 7.6 MITIGATE MITIGATE ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial num

FAQ

How do I fix ecovacs vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ecovacs being exploited right now?

None of the tracked ecovacs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ecovacs CVE should I patch first?

CVE-2024-52325 currently ranks highest (60/100): ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticat.

Products

RSS feed for ecovacs · ← Back to latest CVEs