CVE-2024-52330
EUVD-2024-4625923.01.2025, 17:15
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ecovacs | deebot_x2_omni_firmware | 𝑥 < 1.76.6 |
| ecovacs | deebot_x2_combo_firmware | 𝑥 < 1.81.10 |
| ecovacs | deebot_x2s_firmware | 𝑥 < 1.49.0 |
| ecovacs | deebot_x5_pro_firmware | 𝑥 < 1.70.0 |
| ecovacs | deebot_x5_pro_plus_firmware | 𝑥 < 1.38.0 |
| ecovacs | deebot_x5_pro_ultra_firmware | 𝑥 < 1.17.0 |
| ecovacs | mate_x_firmware | 𝑥 < 1.44.18 |
| ecovacs | deebot_x1_omni_firmware | 𝑥 < 2.4.41 |
| ecovacs | deebot_x1_turbo_firmware | 𝑥 < 2.4.41 |
| ecovacs | deebot_x1_pro_omni_firmware | 𝑥 < 2.4.41 |
| ecovacs | deebot_x1_firmware | 𝑥 < 1.7.3 |
| ecovacs | deebot_x1_plus_firmware | 𝑥 < 1.7.3 |
| ecovacs | deebot_x1s_pro_firmware | 𝑥 < 2.5.31 |
| ecovacs | deebot_x1s_pro_plus_firmware | 𝑥 < 1.23.0 |
| ecovacs | deebot_x1e_omni_firmware | 𝑥 < 2.4.42 |
| ecovacs | deebot_t10_turbo_firmware | 𝑥 < 1.10.0 |
| ecovacs | deebot_t10_plus_firmware | 𝑥 < 1.7.5 |
| ecovacs | deebot_t10_firmware | 𝑥 < 1.7.5 |
| ecovacs | deebot_t10_omni_firmware | 𝑥 < 1.9.0 |
| ecovacs | deebot_x2_pro_firmware | 𝑥 < 1.76.6 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration