PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums

Published 2025-01-23 · Updated 2025-01-23 · CVE-2024-11147

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ECOVACS robot lawnmowers and vacuums (affected versions not specified)

Description The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An attacker with shell access can exploit this to login as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-11147

Affected Products

Ecovacs Robot Lawnmowers/Vacuums

References · 6

• 🔥 https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf · Exploit
• 🔥 https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11147 · Security Note
• https://t.me/cvedetector/16215 · Telegram Post
• https://twitter.com/CVEnew/status/1882501638147256770 · Twitter Post
• https://builder.dontvacuum.me/ecopassword.php · Note