High severity7.4NVD Advisory· Published Jan 23, 2025· Updated Jun 17, 2026
CVE-2024-52330
CVE-2024-52330
Description
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- cpe:2.3:o:ecovacs:deebot_t10_omni_firmware:*:*:*:*:*:*:*:*Range: <1.9.0
- cpe:2.3:o:ecovacs:deebot_t10_plus_firmware:*:*:*:*:*:*:*:*Range: <1.7.5
- cpe:2.3:o:ecovacs:deebot_t10_turbo_firmware:*:*:*:*:*:*:*:*Range: <1.10.0
- cpe:2.3:o:ecovacs:deebot_x1_omni_firmware:*:*:*:*:*:*:*:*Range: <2.4.41
- cpe:2.3:o:ecovacs:deebot_x1_plus_firmware:*:*:*:*:*:*:*:*Range: <1.7.3
- cpe:2.3:o:ecovacs:deebot_x1_pro_omni_firmware:*:*:*:*:*:*:*:*Range: <2.4.41
- cpe:2.3:o:ecovacs:deebot_x1_turbo_firmware:*:*:*:*:*:*:*:*Range: <2.4.41
- cpe:2.3:o:ecovacs:deebot_x1e_omni_firmware:*:*:*:*:*:*:*:*Range: <2.4.42
- cpe:2.3:o:ecovacs:deebot_x1s_pro_firmware:*:*:*:*:*:*:*:*Range: <2.5.31
- cpe:2.3:o:ecovacs:deebot_x1s_pro_plus_firmware:*:*:*:*:*:*:*:*Range: <1.23.0
- cpe:2.3:o:ecovacs:deebot_x2_combo_firmware:*:*:*:*:*:*:*:*Range: <1.81.10
- cpe:2.3:o:ecovacs:deebot_x2_omni_firmware:*:*:*:*:*:*:*:*Range: <1.76.6
- cpe:2.3:o:ecovacs:deebot_x2_pro_firmware:*:*:*:*:*:*:*:*Range: <1.76.6
- cpe:2.3:o:ecovacs:deebot_x5_pro_firmware:*:*:*:*:*:*:*:*Range: <1.70.0
- cpe:2.3:o:ecovacs:deebot_x5_pro_plus_firmware:*:*:*:*:*:*:*:*Range: <1.38.0
- cpe:2.3:o:ecovacs:deebot_x5_pro_ultra_firmware:*:*:*:*:*:*:*:*Range: <1.17.0
- Range: 0
- Range: 0
Patches
Vulnerability mechanics
References
3- dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfnvdExploitThird Party Advisory
- dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfnvdExploitThird Party Advisory
- www.ecovacs.com/global/userhelp/dsa20241217001nvdVendor Advisory
News mentions
0No linked articles in our index yet.