Deebot T10 Omni Firmware

deebot_t10_omni_firmware

Vendor: Ecovacs • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-30200 1Ecovacs 13Deebot T10 Firmware Deebot T10 Omni FirmwareDeebot T10 Plus Firmware+10 more Jun 17, 2026 Sep 5, 2025 2.3 LOW· v4 6.3 MEDIUM· v3 N/A· v2 ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
CVE-2025-30199 1Ecovacs 13Deebot T10 Firmware Deebot T10 Omni FirmwareDeebot T10 Plus Firmware+10 more Jun 17, 2026 Sep 5, 2025 7.5 HIGH· v4 7.2 HIGH· v3 N/A· v2 ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
CVE-2025-30198 1Ecovacs 13Deebot T10 Firmware Deebot T10 Omni FirmwareDeebot T10 Plus Firmware+10 more Jun 17, 2026 Sep 5, 2025 2.3 LOW· v4 6.3 MEDIUM· v3 N/A· v2 ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
CVE-2024-52330 1Ecovacs 20Deebot T10 Firmware Deebot T10 Omni FirmwareDeebot T10 Plus Firmware+17 more Jun 17, 2026 Jan 23, 2025 9.5 CRITICAL· v4 7.4 HIGH· v3 N/A· v2 ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.