CVE-2024-12079

Published: Jan 23, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.

Affected (14)

Products: Ecovacs: Deebot 900 Firmware, Deebot N8 Firmware, Deebot T8 Firmware, Deebot N9 Firmware, Deebot T9 Firmware, Deebot N10 Firmware, Deebot T10 Firmware, Deebot X1 Firmware, Deebot T20 Firmware, Deebot X2 Firmware, Goat G1 Firmware, Airbot Z1 Firmware, Airbot Ava Firmware, Airbot Andy Firmware

14 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot 900 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot 900	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot N8 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot N8	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T8 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot T8	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot N9 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot N9	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T9 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot T9	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot N10 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot N10	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot T10	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot X1	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot T20	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Deebot X2	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Goat G1 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Goat G1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Airbot Z1 Firmware	All versions

Running on/with	Platform Versions
Ecovacs Airbot Z1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Airbot Ava Firmware	All versions

Running on/with	Platform Versions
Ecovacs Airbot Ava	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Airbot Andy Firmware	All versions

Running on/with	Platform Versions
Ecovacs Airbot Andy	All versions

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (1)

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf

Source: 9119a7d8-5eab-497f-8521-727c672e3725

ExploitThird Party Advisory

Timeline

No history available yet.