Riskcovery

CVE-2024-52330

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

State
Published
Severity
9.5 Critical
Published
Jan 23, 2025
Updated
Feb 12, 2025
Reserved
Nov 8, 2024

Read the record on cve.org

Description

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

Scores

CVSSScoreVectorSource
4.09.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:Hcisa-cg
3.17.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Ncisa-cg

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
DEEBOT X5 PRO PLUSECOVACS
  • 1.38.0Not affected
  • before 1.38.0Affected
DEEBOT X5 PROECOVACS
  • 1.70.0Not affected
  • before 1.70.0Affected
DEEBOT X2SECOVACS
  • before 1.49.0Affected
  • 1.49.0Not affected
DEEBOT X2 OMNIECOVACS
  • 1.76.6Not affected
  • before 1.76.6Affected
DEEBOT X1 TURBOECOVACS
  • before 2.4.41Affected
  • 2.4.41Not affected
DEEBOT X1ECOVACS
  • 1.7.3Not affected
  • before 1.7.3Affected
DEEBOT X1S PROECOVACS
  • 2.5.31Not affected
  • before 2.5.31Affected
DEEBOT X1e OMNIECOVACS
  • 2.4.42Not affected
  • before 2.4.42Affected
DEEBOT T10 PLUSECOVACS
  • 1.7.5Not affected
  • before 1.7.5Affected
DEEBOT T10 OMNIECOVACS
  • before 1.9.0Affected
  • 1.9.0Not affected
DEEBOT X5 PRO ULTRAECOVACS
  • before 1.17.0Affected
  • 1.17.0Not affected
Mate XECOVACS
  • 1.44.18Not affected
  • before 1.44.18Affected
DEEBOT X2 PROECOVACS
  • 1.76.6Not affected
  • before 1.76.6Affected
DEEBOT X2 COMBOECOVACS
  • before 1.81.10Affected
  • 1.81.10Not affected
DEEBOT X1 OMNIECOVACS
  • before 2.4.41Affected
  • 2.4.41Not affected
DEEBOT X1 PRO OMNIECOVACS
  • 2.4.41Not affected
  • before 2.4.41Affected
DEEBOT X1 PLUSECOVACS
  • 1.7.3Not affected
  • before 1.7.3Affected
DEEBOT X1S PRO PLUSECOVACS
  • 1.23.0Not affected
  • before 1.23.0Affected
DEEBOT T10 TURBOECOVACS
  • 1.10.0Not affected
  • before 1.10.0Affected
DEEBOT T10ECOVACS
  • before 1.7.5Affected
  • 1.7.5Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.