Vulnerability Description
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ecovacs | Deebot X2 Omni Firmware | < 1.76.6 |
| Ecovacs | Deebot X2 Omni | - |
| Ecovacs | Deebot X2 Combo Firmware | < 1.81.10 |
| Ecovacs | Deebot X2 Combo | - |
| Ecovacs | Deebot X2S Firmware | < 1.49.0 |
| Ecovacs | Deebot X2S | - |
| Ecovacs | Deebot X5 Pro Firmware | < 1.70.0 |
| Ecovacs | Deebot X5 Pro | - |
| Ecovacs | Deebot X5 Pro Plus Firmware | < 1.38.0 |
| Ecovacs | Deebot X5 Pro Plus | - |
| Ecovacs | Deebot X5 Pro Ultra Firmware | < 1.17.0 |
| Ecovacs | Deebot X5 Pro Ultra | - |
| Ecovacs | Mate X Firmware | < 1.44.18 |
| Ecovacs | Mate X | - |
| Ecovacs | Deebot X1 Omni Firmware | < 2.4.41 |
| Ecovacs | Deebot X1 Omni | - |
| Ecovacs | Deebot X1 Turbo Firmware | < 2.4.41 |
| Ecovacs | Deebot X1 Turbo | - |
| Ecovacs | Deebot X1 Pro Omni Firmware | < 2.4.41 |
| Ecovacs | Deebot X1 Pro Omni | - |
Related Weaknesses (CWE)
References
- https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfExploitThird Party Advisory
- https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfExploitThird Party Advisory
- https://www.ecovacs.com/global/userhelp/dsa20241217001Vendor Advisory
FAQ
What is CVE-2024-52330?
CVE-2024-52330 is a vulnerability with a CVSS score of 7.4 (HIGH). ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
How severe is CVE-2024-52330?
CVE-2024-52330 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52330?
Check the references section above for vendor advisories and patch information. Affected products include: Ecovacs Deebot X2 Omni Firmware, Ecovacs Deebot X2 Omni, Ecovacs Deebot X2 Combo Firmware, Ecovacs Deebot X2 Combo, Ecovacs Deebot X2S Firmware.