PT-2025-21745 · Ecovacs · Deebot T10 Series+16

Braelynn Luedtke + 2 · Published 2025-05-16 · Updated 2025-09-06 · CVE-2025-30200

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ECOVACS robot vacuums and base stations (affected versions not specified)

Description ECOVACS robot vacuums and base stations communicate over an insecure Wi-Fi network. The communication utilizes AES encryption with a deterministic key that can be easily derived.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2025-30200

Affected Products

Deebot T10 Series

Deebot T20 Series

Deebot T30 Series

Deebot X1 Series

Deebot T10 Firmware

Deebot T10 Omni Firmware

Deebot T10 Plus Firmware

Deebot T10 Turbo Firmware

Deebot T20 Omni Firmware

Deebot T20 Pro Firmware

Deebot T20 Pro Plus Firmware

Deebot T30 Omni Firmware

Deebot T30S Firmware

Deebot X1 Omni Firmware

Deebot X1 Pro Omni Firmware

Deebot X1 Turbo Firmware

Deebot X1S Pro Firmware

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-30200 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-30200 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30200 · Vendor Advisory
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-135-19 · Note
• https://twitter.com/CVEnew/status/1964195430608359615 · Twitter Post
• https://twitter.com/syedaquib77/status/1923434483547766810 · Twitter Post