CVE-2025-30199

Published: Sep 5, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

Affected (14)

Products: Ecovacs: Deebot X1s Pro Firmware, Deebot X1 Pro Omni Firmware, Deebot X1 Omni Firmware, Deebot X1 Turbo Firmware, Deebot T10 Firmware, Deebot T10 Omni Firmware, Deebot T10 Plus Firmware, Deebot T10 Turbo Firmware, Deebot T20 Omni Firmware, Deebot T20 Pro Plus Firmware, Deebot T20 Pro Firmware, Deebot T30 Omni Firmware, Deebot T30s Firmware

Ecovacs

13 products

Deebot X1s Pro Firmware

Deebot X1 Pro Omni Firmware

Deebot X1 Omni Firmware

Deebot X1 Turbo Firmware

Deebot T10 Firmware

Deebot T10 Omni Firmware

Deebot T10 Plus Firmware

Deebot T10 Turbo Firmware

Deebot T20 Omni Firmware

Deebot T20 Pro Plus Firmware

Deebot T20 Pro Firmware

Deebot T30 Omni Firmware

Deebot T30s Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Firmware	Before 2.5.38

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Pro Omni Firmware	Before 2.5.38

Running on/with	Platform Versions
Ecovacs Deebot X1 Pro Omni	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Omni Firmware	Before 2.4.45

Running on/with	Platform Versions
Ecovacs Deebot X1 Omni	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Turbo Firmware	Before 2.5.38

Running on/with	Platform Versions
Ecovacs Deebot X1 Turbo	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Firmware	Before 2.4.45

Running on/with	Platform Versions
Ecovacs Deebot X1s Pro	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Omni Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Omni	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Plus Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Plus	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Turbo Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Turbo	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Omni Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Omni	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Pro Plus Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Pro Plus	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Pro Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Pro	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30 Omni Firmware	Before 1.100.0

Running on/with	Platform Versions
Ecovacs Deebot T30 Omni	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30s Firmware	Before 1.100.0

Running on/with	Platform Versions
Ecovacs Deebot T30s	All versions

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party Advisory

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party AdvisoryUS Government Resource

https://www.cve.org/CVERecord?id=CVE-2025-30199

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party Advisory

Timeline

No history available yet.