CVE-2024-52325

Published: Jan 23, 2025Modified: Jun 17, 2026

5.8

Vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

Affected (12)

Products: Ecovacs: Goat G1 2000 Firmware, Goat G1 Firmware, Goat G1 800 Firmware, Gx 600 Firmware, Deebot X2 Omni Firmware, Deebot X2 Combo Firmware, Deebot X2s Firmware, Deebot X5 Pro Firmware, Deebot X5 Pro Plus Firmware, Deebot X5 Pro Ultra Firmware, Deebot T30 Omni Firmware, Deebot T30s Firmware

Ecovacs

12 products

Goat G1 2000 Firmware

Goat G1 Firmware

Goat G1 800 Firmware

Gx 600 Firmware

Deebot X2 Omni Firmware

Deebot X2 Combo Firmware

Deebot X2s Firmware

Deebot X5 Pro Firmware

Deebot X5 Pro Plus Firmware

Deebot X5 Pro Ultra Firmware

Deebot T30 Omni Firmware

Deebot T30s Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Goat G1 2000 Firmware	Before 1.36.187

Running on/with	Platform Versions
Ecovacs Goat G1 2000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Goat G1 Firmware	Before 1.36.187

Running on/with	Platform Versions
Ecovacs Goat G1	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Goat G1 800 Firmware	Before 1.36.187

Running on/with	Platform Versions
Ecovacs Goat G1 800	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Gx 600 Firmware	Before 1.2.120

Running on/with	Platform Versions
Ecovacs Gx 600	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Omni Firmware	Before 1.76.6

Running on/with	Platform Versions
Ecovacs Deebot X2 Omni	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Combo Firmware	Before 1.81.10

Running on/with	Platform Versions
Ecovacs Deebot X2 Combo	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2s Firmware	Before 1.49.0

Running on/with	Platform Versions
Ecovacs Deebot X2s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Firmware	Before 1.70.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Plus Firmware	Before 1.38.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro Plus	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Ultra Firmware	Before 1.17.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro Ultra	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30 Omni Firmware	Before 1.93.0

Running on/with	Platform Versions
Ecovacs Deebot T30 Omni	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30s Firmware	Before 1.95.0

Running on/with	Platform Versions
Ecovacs Deebot T30s	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf

Source: 9119a7d8-5eab-497f-8521-727c672e3725

ExploitThird Party Advisory

https://www.ecovacs.com/global/userhelp/dsa20241119

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://www.ecovacs.com/global/userhelp/dsa20241130001

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

https://youtu.be/_wUsM0Mlenc?t=2041

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Exploit

Timeline

No history available yet.