What’s Vulnerable › Vulnerabilities

CVE-2024-12079: ECOVACS lawnmowers cleartext storage of anti-theft PIN

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-312

Description

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.

Affected products

• ECOVACS Airbot Andy Firmware: all versions
• ECOVACS Airbot Ava Firmware: all versions
• ECOVACS Airbot Z1 Firmware: all versions
• ECOVACS Deebot 900 Firmware: all versions
• ECOVACS Deebot N10 Firmware: all versions
• ECOVACS Deebot N8 Firmware: all versions
• ECOVACS Deebot N9 Firmware: all versions
• ECOVACS Deebot T10 Firmware: all versions
• ECOVACS Deebot T20 Firmware: all versions
• ECOVACS Deebot T8 Firmware: all versions
• ECOVACS Deebot T9 Firmware: all versions
• ECOVACS Deebot X1 Firmware: all versions
• ECOVACS Deebot X2 Firmware: all versions
• ECOVACS Goat G1 Firmware: all versions

References

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf

Get alerted when CVE-2024-12079 or the next vulnerability affects your stack