CVE-2024-52331

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cisa-cgCNA
7.5 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
ecovacsdeebot_900_firmware
-
ecovacsdeebot_n8_firmware
-
ecovacsdeebot_t8_firmware
-
ecovacsdeebot_n9_firmware
-
ecovacsdeebot_t9_firmware
-
ecovacsdeebot_n10_firmware
-
ecovacsdeebot_t10_firmware
-
ecovacsdeebot_x1_firmware
-
ecovacsdeebot_t20_firmware
-
ecovacsdeebot_x2_firmware
-
ecovacsgoat_g1_firmware
-
ecovacsairbot_z1_firmware
-
ecovacsairbot_ava_firmware
-
ecovacsairbot_andy_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html