CVE-2025-30200

Published: Sep 5, 2025Modified: Jun 17, 2026

2.3

Vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

Affected (14)

Products: Ecovacs: Deebot X1s Pro Firmware, Deebot X1 Pro Omni Firmware, Deebot X1 Omni Firmware, Deebot X1 Turbo Firmware, Deebot T10 Firmware, Deebot T10 Omni Firmware, Deebot T10 Plus Firmware, Deebot T10 Turbo Firmware, Deebot T20 Omni Firmware, Deebot T20 Pro Plus Firmware, Deebot T20 Pro Firmware, Deebot T30 Omni Firmware, Deebot T30s Firmware

Ecovacs

13 products

Deebot X1s Pro Firmware

Deebot X1 Pro Omni Firmware

Deebot X1 Omni Firmware

Deebot X1 Turbo Firmware

Deebot T10 Firmware

Deebot T10 Omni Firmware

Deebot T10 Plus Firmware

Deebot T10 Turbo Firmware

Deebot T20 Omni Firmware

Deebot T20 Pro Plus Firmware

Deebot T20 Pro Firmware

Deebot T30 Omni Firmware

Deebot T30s Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Firmware	Before 2.5.38

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Pro Omni Firmware	Before 2.5.38

Running on/with	Platform Versions
Ecovacs Deebot X1 Pro Omni	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Omni Firmware	Before 2.4.45

Running on/with	Platform Versions
Ecovacs Deebot X1 Omni	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1 Turbo Firmware	Before 2.5.38

Running on/with	Platform Versions
Ecovacs Deebot X1 Turbo	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot X1s Pro Firmware	Before 2.4.45

Running on/with	Platform Versions
Ecovacs Deebot X1s Pro	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Omni Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Omni	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Plus Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Plus	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T10 Turbo Firmware	Before 1.11.0

Running on/with	Platform Versions
Ecovacs Deebot T10 Turbo	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Omni Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Omni	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Pro Plus Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Pro Plus	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T20 Pro Firmware	Before 1.25.0

Running on/with	Platform Versions
Ecovacs Deebot T20 Pro	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30 Omni Firmware	Before 1.100.0

Running on/with	Platform Versions
Ecovacs Deebot T30 Omni	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ecovacs Deebot T30s Firmware	Before 1.100.0

Running on/with	Platform Versions
Ecovacs Deebot T30s	All versions

Related CWEs

CWE-321

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party Advisory

https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party AdvisoryUS Government Resource

https://www.cve.org/CVERecord?id=CVE-2025-30200

Source: 9119a7d8-5eab-497f-8521-727c672e3725

Third Party Advisory

Timeline

No history available yet.