← Back

CVE-2024-52331

nvd nist
Published: Jan 23, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.7
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

Affected (14)

Ecovacs
14 products
Deebot 900 Firmware
Deebot N8 Firmware
Deebot T8 Firmware
Deebot N9 Firmware
Deebot T9 Firmware
Deebot N10 Firmware
Deebot T10 Firmware
Deebot X1 Firmware
Deebot T20 Firmware
Deebot X2 Firmware
Goat G1 Firmware
Airbot Z1 Firmware
Airbot Ava Firmware
Airbot Andy Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot 900 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot 900
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot N8 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot N8
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot T8 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot T8
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot N9 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot N9
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot T9 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot T9
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot N10 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot N10
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot T10 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot T10
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot X1 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot X1
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot T20 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot T20
All versions
Configuration J
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Deebot X2 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Deebot X2
All versions
Configuration K
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Goat G1 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Goat G1
All versions
Configuration L
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Airbot Z1 Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Airbot Z1
All versions
Configuration M
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Airbot Ava Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Airbot Ava
All versions
Configuration N
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Airbot Andy Firmware
All versions
Running on/withPlatform Versions
Ecovacs
Airbot Andy
All versions

Related CWEs

CWE-1391
Use of Weak Credentials
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
CWE-494
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (2)

Source: 9119a7d8-5eab-497f-8521-727c672e3725
ExploitThird Party Advisory
Source: 9119a7d8-5eab-497f-8521-727c672e3725
ExploitThird Party Advisory

Timeline

No history available yet.