high7.6
CVE-2024-11147
ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number.
Impact
ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Deebot 900 Firmware | All versions |
| Ecovacs | Deebot N8 Firmware | All versions |
| Ecovacs | Deebot T8 Firmware | All versions |
| Ecovacs | Deebot N9 Firmware | All versions |
| Ecovacs | Deebot T9 Firmware | All versions |
| Ecovacs | Deebot N10 Firmware | All versions |
| Ecovacs | Deebot T10 Firmware | All versions |
| Ecovacs | Deebot X1 Firmware | All versions |
| Ecovacs | Deebot T20 Firmware | All versions |
| Ecovacs | Deebot X2 Firmware | All versions |
| Ecovacs | Goat G1 Firmware | All versions |
| Ecovacs | Airbot Z1 Firmware | All versions |