What’s Vulnerable › Vulnerabilities

CVE-2024-12078: ECOVACS lawnmowers and vacuums static BLE GATT encryption key

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-321

Description

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.

Affected products

• ECOVACS Airbot Andy Firmware: all versions
• ECOVACS Airbot Ava Firmware: all versions
• ECOVACS Airbot Z1 Firmware: all versions
• ECOVACS Deebot 900 Firmware: all versions
• ECOVACS Deebot N10 Firmware: all versions
• ECOVACS Deebot N8 Firmware: all versions
• ECOVACS Deebot N9 Firmware: all versions
• ECOVACS Deebot T10 Firmware: all versions
• ECOVACS Deebot T20 Firmware: all versions
• ECOVACS Deebot T8 Firmware: all versions
• ECOVACS Deebot T9 Firmware: all versions
• ECOVACS Deebot X1 Firmware: all versions
• ECOVACS Deebot X2 Firmware: all versions
• ECOVACS Goat G1 Firmware: all versions

References

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
• https://youtu.be/_wUsM0Mlenc?t=2041

Get alerted when CVE-2024-12078 or the next vulnerability affects your stack