PT-2025-2928 · Ecovacs · Ecovacs

Braelynn Luedtke + 1 · CVE-2024-52330 · Published 2025-01-23 · Updated 2025-01-23

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ECOVACS lawnmowers and vacuums (affected versions not specified)

Description The issue concerns the improper validation of TLS certificates by ECOVACS lawnmowers and vacuums. This allows an unauthenticated attacker to read or modify TLS traffic, which could potentially lead to the modification of firmware updates.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-52330

Affected Products

Ecovacs

References · 9

• 🔥 https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf · Exploit
• 🔥 https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf · Exploit
• https://ecovacs.com/global/userhelp/dsa20241217001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52330 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52330 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1882473834105721259 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1882484445468377593 · Twitter Post
• https://t.me/cvedetector/16210 · Telegram Post
• https://twitter.com/CVEnew/status/1882501639778779244 · Twitter Post