medium6.3
CVE-2024-12078
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages.
Impact
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Deebot N10 Firmware | All versions |
| Ecovacs | Deebot T10 Firmware | All versions |
| Ecovacs | Deebot X1 Firmware | All versions |
| Ecovacs | Deebot T20 Firmware | All versions |
| Ecovacs | Deebot X2 Firmware | All versions |
| Ecovacs | Goat G1 Firmware | All versions |
| Ecovacs | Airbot Z1 Firmware | All versions |
| Ecovacs | Airbot Ava Firmware | All versions |
| Ecovacs | Airbot Andy Firmware | All versions |
| Ecovacs | Deebot 900 Firmware | All versions |
| Ecovacs | Deebot N8 Firmware | All versions |
| Ecovacs | Deebot T8 Firmware | All versions |