Skip to content
OpenAdvisories

Vendor

ECOVACS

13 known vulnerabilities.

Products

Unspecified robots 5 DEEBOT X1 Series 3 DEEBOT T20 Series 3 DEEBOT T10 Series 3 DEEBOT T30 Series 3 ECOVACS HOME 2 DEEBOT X2S 2 DEEBOT X5 PRO 2 DEEBOT X5 PRO PLUS 2 DEEBOT X2 OMNI 2 DEEBOT X2 COMBO 2 DEEBOT X5 PRO ULTRA 2 DEEBOT X1 TURBO 1 DEEBOT X1 1 DEEBOT X1S PRO 1 DEEBOT X1e OMNI 1 DEEBOT T10 PLUS 1 DEEBOT T10 OMNI 1 Mate X 1 DEEBOT X2 PRO 1 DEEBOT X1 OMNI 1 DEEBOT X1 PRO OMNI 1 DEEBOT X1 PLUS 1 DEEBOT X1S PRO PLUS 1 DEEBOT T10 TURBO 1 DEEBOT T10 1 cloud service 1 GOAT G1 1 GOAT G1-800 1 DEEBOT T30 OMNI 1 DEEBOT T30S 1 GOAT G1-2000 1 GOAT GX-600 1 Ecovacs Mobile and Android Application 1 X1S PRO 0 X1 PRO OMNI 0 X1 OMNI 0 X1 TURBO 0 T10 Series 0 T20 Series 0
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-30198

    ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK

    ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

    ECOVACS DEEBOT T20 Series DEEBOT T30 Series DEEBOT X1 Series
  • Medium 6.3
    CVE-2025-30200

    ECOVACS Vacuum and Base Station Hard-Coded AES Encryption

    ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.

    ECOVACS DEEBOT T20 Series DEEBOT T30 Series DEEBOT X1 Series
  • Medium 4.7
    CVE-2025-2394

    Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications

    Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.

    ECOVACS Ecovacs Mobile and Android Application Android
  • Medium 6.5
    CVE-2024-52327

    ECOVACS lawnmower and vacuum cloud service live video PIN bypass

    The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.

    ECOVACS ECOVACS HOME cloud service
  • Medium 6.3
    CVE-2024-12078

    ECOVACS lawnmowers and vacuums static BLE GATT encryption key

    ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.

    ECOVACS Unspecified robots