high7.4
CVE-2024-52330
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates.
Impact
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Deebot X2 Omni Firmware | before 1.76.6 |
| Ecovacs | Deebot X2 Combo Firmware | before 1.81.10 |
| Ecovacs | Deebot X2s Firmware | before 1.49.0 |
| Ecovacs | Deebot X5 Pro Firmware | before 1.70.0 |
| Ecovacs | Deebot X5 Pro Plus Firmware | before 1.38.0 |
| Ecovacs | Deebot X5 Pro Ultra Firmware | before 1.17.0 |
| Ecovacs | Mate X Firmware | before 1.44.18 |
| Ecovacs | Deebot X1 Omni Firmware | before 2.4.41 |
| Ecovacs | Deebot X1 Turbo Firmware | before 2.4.41 |
| Ecovacs | Deebot X1 Pro Omni Firmware | before 2.4.41 |
| Ecovacs | Deebot X1 Firmware | before 1.7.3 |
| Ecovacs | Deebot X1 Plus Firmware | before 1.7.3 |