PT-2025-36259 · Ecovacs · Ecovacs Vacuum Robot Base Stations

Braelynn Luedtke + 2 · Published 2025-09-05 · Updated 2025-09-06 · CVE-2025-30199

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ECOVACS vacuum robot base stations (affected versions not specified)

Description ECOVACS vacuum robot base stations do not validate firmware updates, allowing malicious over-the-air updates to be sent to the base station via an insecure connection between the robot and the base station.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-30199

Affected Products

Ecovacs Vacuum Robot Base Stations

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-30199 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-30199 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30199 · Vendor Advisory
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-135-19 · Note
• https://twitter.com/CVEnew/status/1964195428712534272 · Twitter Post