CVE Feed

    Dashboard / CVE / CVE-2025-30199

    CVE-2025-30199

    ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

    Published:Sep 5, 2025
    Last Modified:Sep 23, 2025
    EPS:Sep 5, 2025
    EPSS Score:0.0002
    CVSS Score:7.2

    Affected Products

    Vendor
    Ecovacs
    Product
    Deebot T10
    Vendor
    Ecovacs
    Product
    Deebot T10 Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Omni
    Vendor
    Ecovacs
    Product
    Deebot T10 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Plus
    Vendor
    Ecovacs
    Product
    Deebot T10 Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot T10 Turbo
    Vendor
    Ecovacs
    Product
    Deebot T10 Turbo Firmware
    Vendor
    Ecovacs
    Product
    Deebot T20 Omni
    Vendor
    Ecovacs
    Product
    Deebot T20 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot T20 Pro
    Vendor
    Ecovacs
    Product
    Deebot T20 Pro Firmware
    Vendor
    Ecovacs
    Product
    Deebot T20 Pro Plus
    Vendor
    Ecovacs
    Product
    Deebot T20 Pro Plus Firmware
    Vendor
    Ecovacs
    Product
    Deebot T30 Omni
    Vendor
    Ecovacs
    Product
    Deebot T30 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot T30s
    Vendor
    Ecovacs
    Product
    Deebot T30s Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Omni
    Vendor
    Ecovacs
    Product
    Deebot X1 Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Pro Omni
    Vendor
    Ecovacs
    Product
    Deebot X1 Pro Omni Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1 Turbo
    Vendor
    Ecovacs
    Product
    Deebot X1 Turbo Firmware
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro
    Vendor
    Ecovacs
    Product
    Deebot X1s Pro Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-30198 (CVSS 2.3) — ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PS…
    CVE-2025-30200 (CVSS 2.3) — ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES enc…
    CVE-2024-12079 (CVSS 4.8) — ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal…
    CVE-2024-12078 (CVSS 5.3) — ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthe…
    CVE-2024-11147 (CVSS 7) — ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial num…
    CVE-2024-52331 (CVSS 7.7) — ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacke…
    CVE-2024-52330 (CVSS 9.5) — ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read…
    CVE-2024-52328 (CVSS 1.8) — ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High