What’s Vulnerable › Vulnerabilities

CVE-2024-52331: ECOVACS lawnmowers and vacuums deterministic firmware encryption key

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-23 · updated 2026-06-17
• Weakness: CWE-327

Description

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

Affected products

• ECOVACS Airbot Andy Firmware: all versions
• ECOVACS Airbot Ava Firmware: all versions
• ECOVACS Airbot Z1 Firmware: all versions
• ECOVACS Deebot 900 Firmware: all versions
• ECOVACS Deebot N10 Firmware: all versions
• ECOVACS Deebot N8 Firmware: all versions
• ECOVACS Deebot N9 Firmware: all versions
• ECOVACS Deebot T10 Firmware: all versions
• ECOVACS Deebot T20 Firmware: all versions
• ECOVACS Deebot T8 Firmware: all versions
• ECOVACS Deebot T9 Firmware: all versions
• ECOVACS Deebot X1 Firmware: all versions
• ECOVACS Deebot X2 Firmware: all versions
• ECOVACS Goat G1 Firmware: all versions

References

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html

Get alerted when CVE-2024-52331 or the next vulnerability affects your stack