PT-2025-2924 · Ecovacs · Ecovacs

Braelynn Luedtke + 2 · Published 2025-01-23 · Updated 2025-01-23 · CVE-2024-52325

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ECOVACS robot lawnmowers and vacuums (affected versions not specified)

Description The issue concerns command injection via the SetNetPin() function over an unauthenticated Bluetooth Low Energy (BLE) connection. This allows for potential exploitation without the need for authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-52325

Affected Products

Ecovacs

References · 8

• 🔥 https://youtu.be/_wUsM0Mlenc?t=2041 · Exploit
• 🔥 https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf · Exploit
• https://ecovacs.com/global/userhelp/dsa20241119 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52325 · Vendor Advisory
• https://ecovacs.com/global/userhelp/dsa20241130001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52325 · Security Note
• https://twitter.com/CVEnew/status/1882501643318788201 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1882574048153997778 · Twitter Post