High severity7.4NVD Advisory· Published Jan 23, 2025· Updated Jun 17, 2026

CVE-2024-52329

Description

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

Affected products

Ecovacs/Home2 versions
cpe:2.3:a:ecovacs:home:*:*:*:*:*:android:*:*+ 1 more
- cpe:2.3:a:ecovacs:home:*:*:*:*:*:android:*:*range: <3.0.0
- cpe:2.3:a:ecovacs:home:*:*:*:*:*:iphone_os:*:*range: <3.0.0
Ecovacs/HOME mobile app pluginsllm-create
ECOVACS/ECOVACS HOMEv5
Range: 0

Patches

Vulnerability mechanics

References

dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfnvdExploitThird Party Advisory
dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfnvdExploitThird Party Advisory
www.ecovacs.com/global/userhelp/dsa20241217001nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000