What’s Vulnerable › Vulnerabilities

CVE-2024-52328: ECOVACS lawnmowers and vacuums insecurely store audio warning files

• Severity: low (CVSS 2.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-732

Description

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.

Affected products

• ECOVACS Airbot Andy Firmware: all versions
• ECOVACS Airbot Ava Firmware: all versions
• ECOVACS Airbot Z1 Firmware: all versions
• ECOVACS Deebot 900 Firmware: all versions
• ECOVACS Deebot N10 Firmware: all versions
• ECOVACS Deebot N8 Firmware: all versions
• ECOVACS Deebot N9 Firmware: all versions
• ECOVACS Deebot T10 Firmware: all versions
• ECOVACS Deebot T20 Firmware: all versions
• ECOVACS Deebot T8 Firmware: all versions
• ECOVACS Deebot T9 Firmware: all versions
• ECOVACS Deebot X1 Firmware: all versions
• ECOVACS Deebot X2 Firmware: all versions
• ECOVACS Goat G1 Firmware: all versions

References

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf

Get alerted when CVE-2024-52328 or the next vulnerability affects your stack