high7.5
CVE-2024-52331
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates.
Impact
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ecovacs | Deebot 900 Firmware | All versions |
| Ecovacs | Deebot N8 Firmware | All versions |
| Ecovacs | Deebot T8 Firmware | All versions |
| Ecovacs | Deebot N9 Firmware | All versions |
| Ecovacs | Deebot T9 Firmware | All versions |
| Ecovacs | Deebot N10 Firmware | All versions |
| Ecovacs | Deebot T10 Firmware | All versions |
| Ecovacs | Deebot X1 Firmware | All versions |
| Ecovacs | Deebot T20 Firmware | All versions |
| Ecovacs | Deebot X2 Firmware | All versions |
| Ecovacs | Goat G1 Firmware | All versions |
| Ecovacs | Airbot Z1 Firmware | All versions |