PT-2025-22570 · Ecovacs · Ecovacs Home

Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-2394

Positive Technologies (AI Summary)

CVSS v4.0

4.7

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Ecovacs Home Android and iOS Mobile Applications versions up to 3.3.0

Description The issue concerns the disclosure of sensitive data due to embedded access keys and secrets for Alibaba Object Storage Service (OSS) in the Ecovacs Home mobile applications.

Recommendations For versions up to 3.3.0, consider removing or securely storing the embedded access keys and secrets for Alibaba Object Storage Service (OSS) to prevent sensitive data disclosure. As a temporary workaround, restrict access to the Alibaba Object Storage Service (OSS) until a secure update is available.

Fix

Insufficiently Protected Credentials

Using Hardcoded Credentials

Weakness Enumeration

CWE-522

CWE-798

Related Identifiers

CVE-2025-2394

Affected Products

Ecovacs Home

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-2394 · Security Note
• https://t.me/cvetracker/24514 · Telegram Post
• https://twitter.com/CVEnew/status/1925879155150713308 · Twitter Post
• https://ecovacs.com/global/userhelp/dsa20250507001 · Note
• https://themissinglink.com.au/security-advisories/cve-2025-2394 · Note