low2.3
CVE-2024-52328
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on.
Impact
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Deebot N8 Firmware | All versions |
| Ecovacs | Deebot 900 Firmware | All versions |
| Ecovacs | Deebot T8 Firmware | All versions |
| Ecovacs | Deebot N9 Firmware | All versions |
| Ecovacs | Deebot T9 Firmware | All versions |
| Ecovacs | Deebot N10 Firmware | All versions |
| Ecovacs | Deebot T10 Firmware | All versions |
| Ecovacs | Deebot X1 Firmware | All versions |
| Ecovacs | Deebot T20 Firmware | All versions |
| Ecovacs | Deebot X2 Firmware | All versions |
| Ecovacs | Goat G1 Firmware | All versions |
| Ecovacs | Airbot Z1 Firmware | All versions |