Description
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ECOVACS | DEEBOT X5 PRO PLUS | < 1.38.0 | 1.38.0 |
| ECOVACS | DEEBOT X5 PRO | < 1.70.0 | 1.70.0 |
| ECOVACS | DEEBOT X2S | < 1.49.0 | 1.49.0 |
| ECOVACS | DEEBOT X2 OMNI | < 1.76.6 | 1.76.6 |
| ECOVACS | DEEBOT X1 TURBO | < 2.4.41 | 2.4.41 |
| ECOVACS | DEEBOT X1 | < 1.7.3 | 1.7.3 |
| ECOVACS | DEEBOT X1S PRO | < 2.5.31 | 2.5.31 |
| ECOVACS | DEEBOT X1e OMNI | < 2.4.42 | 2.4.42 |
| ECOVACS | DEEBOT T10 PLUS | < 1.7.5 | 1.7.5 |
| ECOVACS | DEEBOT T10 OMNI | < 1.9.0 | 1.9.0 |
| ECOVACS | DEEBOT X5 PRO ULTRA | < 1.17.0 | 1.17.0 |
| ECOVACS | Mate X | < 1.44.18 | 1.44.18 |
| ECOVACS | DEEBOT X2 PRO | < 1.76.6 | 1.76.6 |
| ECOVACS | DEEBOT X2 COMBO | < 1.81.10 | 1.81.10 |
| ECOVACS | DEEBOT X1 OMNI | < 2.4.41 | 2.4.41 |
| ECOVACS | DEEBOT X1 PRO OMNI | < 2.4.41 | 2.4.41 |
| ECOVACS | DEEBOT X1 PLUS | < 1.7.3 | 1.7.3 |
| ECOVACS | DEEBOT X1S PRO PLUS | < 1.23.0 | 1.23.0 |
| ECOVACS | DEEBOT T10 TURBO | < 1.10.0 | 1.10.0 |
| ECOVACS | DEEBOT T10 | < 1.7.5 | 1.7.5 |
Advisories 1
- VA-25-022-01 ECOVACS lawnmower and vacuum vulnerabilities CISA ICS & IT advisories · Jan 23, 2025