Vulnerability Description
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ecovacs | Home | < 3.0.2 |
Related Weaknesses (CWE)
References
- https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfExploitThird Party Advisory
- https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfExploitThird Party Advisory
- https://www.ecovacs.com/global/userhelp/dsa20241217002Vendor Advisory
FAQ
What is CVE-2024-52327?
CVE-2024-52327 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
How severe is CVE-2024-52327?
CVE-2024-52327 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52327?
Check the references section above for vendor advisories and patch information. Affected products include: Ecovacs Home.