CVE-2024-52330

Published: Jan 23, 2025Modified: Jun 17, 2026

9.5

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

Affected (20)

Products: Ecovacs: Deebot X2 Omni Firmware, Deebot X2 Combo Firmware, Deebot X2s Firmware, Deebot X5 Pro Firmware, Deebot X5 Pro Plus Firmware, Deebot X5 Pro Ultra Firmware, Mate X Firmware, Deebot X1 Omni Firmware, Deebot X1 Turbo Firmware, Deebot X1 Pro Omni Firmware, Deebot X1 Firmware, Deebot X1 Plus Firmware, Deebot X1s Pro Firmware, Deebot X1s Pro Plus Firmware, Deebot X1e Omni Firmware, Deebot T10 Turbo Firmware, Deebot T10 Plus Firmware, Deebot T10 Firmware, Deebot T10 Omni Firmware, Deebot X2 Pro Firmware

Ecovacs

20 products

Deebot X2 Omni Firmware

Deebot X2 Combo Firmware

Deebot X2s Firmware

Deebot X5 Pro Firmware

Deebot X5 Pro Plus Firmware

Deebot X5 Pro Ultra Firmware

Mate X Firmware

Deebot X1 Omni Firmware

Deebot X1 Turbo Firmware

Deebot X1 Pro Omni Firmware

Deebot X1 Firmware

Deebot X1 Plus Firmware

Deebot X1s Pro Firmware

Deebot X1s Pro Plus Firmware

Deebot X1e Omni Firmware

Deebot T10 Turbo Firmware

Deebot T10 Plus Firmware

Deebot T10 Firmware

Deebot T10 Omni Firmware

Deebot X2 Pro Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Omni Firmware	Before 1.76.6

Running on/with	Platform Versions
Ecovacs Deebot X2 Omni	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Combo Firmware	Before 1.81.10

Running on/with	Platform Versions
Ecovacs Deebot X2 Combo	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2s Firmware	Before 1.49.0

Running on/with	Platform Versions
Ecovacs Deebot X2s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Firmware	Before 1.70.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Plus Firmware	Before 1.38.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro Plus	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X5 Pro Ultra Firmware	Before 1.17.0

Running on/with	Platform Versions
Ecovacs Deebot X5 Pro Ultra	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Mate X Firmware	Before 1.44.18

Running on/with	Platform Versions
Ecovacs Mate X	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Omni Firmware	Before 2.4.41

Running on/with	Platform Versions
Ecovacs Deebot X1 Omni	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Turbo Firmware	Before 2.4.41

Running on/with	Platform Versions
Ecovacs Deebot X1 Turbo	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Pro Omni Firmware	Before 2.4.41

Running on/with	Platform Versions
Ecovacs Deebot X1 Pro Omni	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Firmware	Before 1.7.3

Running on/with	Platform Versions
Ecovacs Deebot X1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Plus Firmware	Before 1.7.3

Running on/with	Platform Versions
Ecovacs Deebot X1 Plus	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Firmware	Before 2.5.31

Running on/with	Platform Versions
Ecovacs Deebot X1s Pro	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Plus Firmware	Before 1.23.0

Running on/with	Platform Versions
Ecovacs Deebot X1s Pro Plus	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1e Omni Firmware	Before 2.4.42

Running on/with	Platform Versions
Ecovacs Deebot X1e Omni	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Turbo Firmware	Before 1.10.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Turbo	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Plus Firmware	Before 1.7.5

Running on/with	Platform Versions
Ecovacs Deebot T10 Plus	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Firmware	Before 1.7.5

Running on/with	Platform Versions
Ecovacs Deebot T10	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Omni Firmware	Before 1.9.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Omni	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X2 Pro Firmware	Before 1.76.6

Running on/with	Platform Versions
Ecovacs Deebot X2 Pro	All versions

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (3)

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf

Source: 9119a7d8-5eab-497f-8521-727c672e3725

ExploitThird Party Advisory

https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf

Source: 9119a7d8-5eab-497f-8521-727c672e3725

ExploitThird Party Advisory

https://www.ecovacs.com/global/userhelp/dsa20241217001

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Vendor Advisory

Timeline

No history available yet.