https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-30200.htmlhttps://patchthecve.com/cve/CVE-2025-30200.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.https://patchthecve.com/cve/CVE-2025-30199.htmlhttps://patchthecve.com/cve/CVE-2025-30199.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.2: ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.https://patchthecve.com/cve/CVE-2025-30198.htmlhttps://patchthecve.com/cve/CVE-2025-30198.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.https://patchthecve.com/cve/CVE-2024-52331.htmlhttps://patchthecve.com/cve/CVE-2024-52331.htmlWed, 17 Jun 2026 08:07:01 +0000HIGH 7.5: ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.https://patchthecve.com/cve/CVE-2024-52330.htmlhttps://patchthecve.com/cve/CVE-2024-52330.htmlWed, 17 Jun 2026 08:07:01 +0000HIGH 7.4: ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.https://patchthecve.com/cve/CVE-2024-52329.htmlhttps://patchthecve.com/cve/CVE-2024-52329.htmlWed, 17 Jun 2026 08:07:01 +0000HIGH 7.4: ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.https://patchthecve.com/cve/CVE-2024-52328.htmlhttps://patchthecve.com/cve/CVE-2024-52328.htmlWed, 17 Jun 2026 08:07:01 +0000LOW 2.3: ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.https://patchthecve.com/cve/CVE-2024-52327.htmlhttps://patchthecve.com/cve/CVE-2024-52327.htmlWed, 17 Jun 2026 08:07:01 +0000MEDIUM 6.5: The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.https://patchthecve.com/cve/CVE-2024-12079.htmlhttps://patchthecve.com/cve/CVE-2024-12079.htmlWed, 17 Jun 2026 06:59:00 +0000LOW 3.3: ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.https://patchthecve.com/cve/CVE-2024-12078.htmlhttps://patchthecve.com/cve/CVE-2024-12078.htmlWed, 17 Jun 2026 06:59:00 +0000MEDIUM 6.3: ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.https://patchthecve.com/cve/CVE-2024-11147.htmlhttps://patchthecve.com/cve/CVE-2024-11147.htmlWed, 17 Jun 2026 06:57:10 +0000HIGH 7.6: ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.https://patchthecve.com/cve/CVE-2024-52325.htmlhttps://patchthecve.com/cve/CVE-2024-52325.htmlWed, 17 Jun 2026 08:07:01 +0000CRITICAL 9.6: ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.