Skip to content
OpenAdvisories
Critical · 9.6 CVE-2024-52325 EUVD-2024-46255GHSA-wgmc-5v7x-58m5

ECOVACS robot lawnmowers and vacuums command injection

Published Jan 23, 2025 · Updated Feb 12, 2025 · Assigned by cisa-cg

Vendor: ECOVACS Product: DEEBOT T30 OMNI Product: DEEBOT T30S Product: DEEBOT X2 OMNI Product: DEEBOT X2 COMBO Product: DEEBOT X2S Product: DEEBOT X5 PRO Product: DEEBOT X5 PRO PLUS Product: DEEBOT X5 PRO ULTRA Product: GOAT G1 Product: GOAT G1-2000 Product: GOAT G1-800 Product: GOAT GX-600

Description

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

Affected products

VendorProductAffectedFixed
ECOVACS GOAT G1 < 1.36.187 1.36.187
ECOVACS GOAT G1-800 < 1.36.187 1.36.187
ECOVACS DEEBOT X2S < 1.49.0 1.49.0
ECOVACS DEEBOT X5 PRO < 1.70.0 1.70.0
ECOVACS DEEBOT X5 PRO PLUS < 1.38.0 1.38.0
ECOVACS DEEBOT T30 OMNI < 1.93.0 1.93.0
ECOVACS DEEBOT T30S < 1.95.0 1.95.0
ECOVACS GOAT G1-2000 < 1.36.187 1.36.187
ECOVACS GOAT GX-600 < 1.2.120 1.2.120
ECOVACS DEEBOT X2 OMNI < 1.76.6 1.76.6
ECOVACS DEEBOT X2 COMBO < 1.81.10 1.81.10
ECOVACS DEEBOT X5 PRO ULTRA < 1.17.0 1.17.0

Advisories 1

References