critical9.6
CVE-2024-52325
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
Impact
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Goat G1-2000 Firmware | before 1.36.187 |
| Ecovacs | Goat G1 Firmware | before 1.36.187 |
| Ecovacs | Goat G1-800 Firmware | before 1.36.187 |
| Ecovacs | Gx-600 Firmware | before 1.2.120 |
| Ecovacs | Deebot X2 Omni Firmware | before 1.76.6 |
| Ecovacs | Deebot X2 Combo Firmware | before 1.81.10 |
| Ecovacs | Deebot X2s Firmware | before 1.49.0 |
| Ecovacs | Deebot X5 Pro Firmware | before 1.70.0 |
| Ecovacs | Deebot X5 Pro Plus Firmware | before 1.38.0 |
| Ecovacs | Deebot X5 Pro Ultra Firmware | before 1.17.0 |
| Ecovacs | Deebot T30 Omni Firmware | before 1.93.0 |
| Ecovacs | Deebot T30s Firmware | before 1.95.0 |