Deebot X2 Firmware

deebot_x2_firmware

Vendor: Ecovacs • 5 CVEs

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-52331 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 7.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
CVE-2024-52328 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 1.8 LOW· v4 2.3 LOW· v3 N/A· v2 ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be awar...Show more ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.Show less
CVE-2024-12079 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 4.8 MEDIUM· v4 3.3 LOW· v3 N/A· v2 ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.
CVE-2024-12078 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 5.3 MEDIUM· v4 6.3 MEDIUM· v3 N/A· v2 ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
CVE-2024-11147 1Ecovacs 14Airbot Andy Firmware Airbot Ava FirmwareAirbot Z1 Firmware+11 more Jun 17, 2026 Jan 23, 2025 7.0 HIGH· v4 7.6 HIGH· v3 N/A· v2 ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.