CVE Feed

    Dashboard / CVE / CVE-2024-52330

    CVE-2024-52330

    ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

    Published:Jan 23, 2025
    Last Modified:Sep 23, 2025
    EPS:Jan 23, 2025
    EPSS Score:0.00045
    CVSS Score:7.4

    Affected Products

    Vendor
    Ecovacs
    Product
    Deebot T10
    Vendor
    Ecovacs
    Product
    Deebot T10 Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Omni
    Vendor
    Ecovacs
    Product
    Deebot T10 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Plus
    Vendor
    Ecovacs
    Product
    Deebot T10 Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Turbo
    Vendor
    Ecovacs
    Product
    Deebot T10 Turbo Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1
    Vendor
    Ecovacs
    Product
    Deebot X1 Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Omni
    Vendor
    Ecovacs
    Product
    Deebot X1 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Plus
    Vendor
    Ecovacs
    Product
    Deebot X1 Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Pro Omni
    Vendor
    Ecovacs
    Product
    Deebot X1 Pro Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Turbo
    Vendor
    Ecovacs
    Product
    Deebot X1 Turbo Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1e Omni
    Vendor
    Ecovacs
    Product
    Deebot X1e Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro Plus
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot X2 Combo
    Vendor
    Ecovacs
    Product
    Deebot X2 Combo Firmware
    Vendor
    Ecovacs
    Product
    Deebot X2 Omni
    Vendor
    Ecovacs
    Product
    Deebot X2 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X2 Pro
    Vendor
    Ecovacs
    Product
    Deebot X2 Pro Firmware
    Vendor
    Ecovacs
    Product
    Deebot X2s
    Vendor
    Ecovacs
    Product
    Deebot X2s Firmware
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro Firmware
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro Plus
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro Ultra
    Vendor
    Ecovacs
    Product
    Deebot X5 Pro Ultra Firmware
    Vendor
    Ecovacs
    Product
    Mate X
    Vendor
    Ecovacs
    Product
    Mate X Firmware

    Exploits

    https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfhttps://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2025-30198 (CVSS 2.3) — ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PS…
    CVE-2025-30199 (CVSS 7.5) — ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be …
    CVE-2025-30200 (CVSS 2.3) — ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES enc…
    CVE-2024-12079 (CVSS 4.8) — ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal…
    CVE-2024-12078 (CVSS 5.3) — ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthe…
    CVE-2024-11147 (CVSS 7) — ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial num…
    CVE-2024-52331 (CVSS 7.7) — ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacke…
    CVE-2024-52328 (CVSS 1.8) — ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High