What’s Vulnerable › Vulnerabilities

CVE-2024-11147: ECOVACS lawnmowers and vacuums deterministic root password

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-798

Description

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

Affected products

• ECOVACS Airbot Andy Firmware: all versions
• ECOVACS Airbot Ava Firmware: all versions
• ECOVACS Airbot Z1 Firmware: all versions
• ECOVACS Deebot 900 Firmware: all versions
• ECOVACS Deebot N10 Firmware: all versions
• ECOVACS Deebot N8 Firmware: all versions
• ECOVACS Deebot N9 Firmware: all versions
• ECOVACS Deebot T10 Firmware: all versions
• ECOVACS Deebot T20 Firmware: all versions
• ECOVACS Deebot T8 Firmware: all versions
• ECOVACS Deebot T9 Firmware: all versions
• ECOVACS Deebot X1 Firmware: all versions
• ECOVACS Deebot X2 Firmware: all versions
• ECOVACS Goat G1 Firmware: all versions

References

• https://builder.dontvacuum.me/ecopassword.php
• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf

Get alerted when CVE-2024-11147 or the next vulnerability affects your stack