Unrated severityNVD Advisory· Published Jan 23, 2025· Updated Feb 12, 2025

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

CVE-2024-52330

Description

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

Affected products

Ecovacs/Deebot X2 Prov5
Range: 0
Ecovacs/Deebot T10 Omniv5
Range: 0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfmitre
dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfmitre
www.ecovacs.com/global/userhelp/dsa20241217001mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000