What’s Vulnerable › Vulnerabilities

CVE-2024-52330: ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-295

Description

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

Affected products

• ECOVACS Deebot T10 Firmware: before 1.7.5 — fixed in 1.7.5
• ECOVACS Deebot T10 Omni Firmware: before 1.9.0 — fixed in 1.9.0
• ECOVACS Deebot T10 Plus Firmware: before 1.7.5 — fixed in 1.7.5
• ECOVACS Deebot T10 Turbo Firmware: before 1.10.0 — fixed in 1.10.0
• ECOVACS Deebot X1 Firmware: before 1.7.3 — fixed in 1.7.3
• ECOVACS Deebot X1 Omni Firmware: before 2.4.41 — fixed in 2.4.41
• ECOVACS Deebot X1 Plus Firmware: before 1.7.3 — fixed in 1.7.3
• ECOVACS Deebot X1 Pro Omni Firmware: before 2.4.41 — fixed in 2.4.41
• ECOVACS Deebot X1 Turbo Firmware: before 2.4.41 — fixed in 2.4.41
• ECOVACS Deebot X1E Omni Firmware: before 2.4.42 — fixed in 2.4.42
• ECOVACS Deebot X1S Pro Firmware: before 2.5.31 — fixed in 2.5.31
• ECOVACS Deebot X1S Pro Plus Firmware: before 1.23.0 — fixed in 1.23.0
• ECOVACS Deebot X2 Combo Firmware: before 1.81.10 — fixed in 1.81.10
• ECOVACS Deebot X2 Omni Firmware: before 1.76.6 — fixed in 1.76.6
• ECOVACS Deebot X2 Pro Firmware: before 1.76.6 — fixed in 1.76.6
• ECOVACS Deebot X2S Firmware: before 1.49.0 — fixed in 1.49.0
• ECOVACS Deebot X5 Pro Firmware: before 1.70.0 — fixed in 1.70.0
• ECOVACS Deebot X5 Pro Plus Firmware: before 1.38.0 — fixed in 1.38.0
• ECOVACS Deebot X5 Pro Ultra Firmware: before 1.17.0 — fixed in 1.17.0
• ECOVACS Mate X Firmware: before 1.44.18 — fixed in 1.44.18

How to fix

Upgrade to a fixed version: ECOVACS Deebot T10 Firmware 1.7.5; ECOVACS Deebot T10 Omni Firmware 1.9.0; ECOVACS Deebot T10 Plus Firmware 1.7.5; ECOVACS Deebot T10 Turbo Firmware 1.10.0; ECOVACS Deebot X1 Firmware 1.7.3; ECOVACS Deebot X1 Omni Firmware 2.4.41; ECOVACS Deebot X1 Plus Firmware 1.7.3; ECOVACS Deebot X1 Pro Omni Firmware 2.4.41; ECOVACS Deebot X1 Turbo Firmware 2.4.41; ECOVACS Deebot X1E Omni Firmware 2.4.42; ECOVACS Deebot X1S Pro Firmware 2.5.31; ECOVACS Deebot X1S Pro Plus Firmware 1.23.0. Check the vendor advisory for mitigations.

References

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
• https://www.ecovacs.com/global/userhelp/dsa20241217001

Get alerted when CVE-2024-52330 or the next vulnerability affects your stack