Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2024-52325

ECOVACS robot lawnmowers and vacuums command injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ECOVACS GOAT G1

Default version status: unknown

  • 0 to < 1.36.187affected
  • 1.36.187unaffected

ECOVACS GOAT G1-800

Default version status: unknown

  • 0 to < 1.36.187affected
  • 1.36.187unaffected

ECOVACS DEEBOT X2S

Default version status: unknown

  • 0 to < 1.49.0affected
  • 1.49.0unaffected

ECOVACS DEEBOT X5 PRO

Default version status: unknown

  • 0 to < 1.70.0affected
  • 1.70.0unaffected

ECOVACS DEEBOT X5 PRO PLUS

Default version status: unknown

  • 0 to < 1.38.0affected
  • 1.38.0unaffected

ECOVACS DEEBOT T30 OMNI

Default version status: unknown

  • 0 to < 1.93.0affected
  • 1.93.0unaffected

ECOVACS DEEBOT T30S

Default version status: unknown

  • 0 to < 1.95.0affected
  • 1.95.0unaffected

ECOVACS GOAT G1-2000

Default version status: unknown

  • 0 to < 1.36.187affected
  • 1.36.187unaffected

ECOVACS GOAT GX-600

Default version status: unknown

  • 0 to < 1.2.120affected
  • 1.2.120unaffected

ECOVACS DEEBOT X2 OMNI

Default version status: unknown

  • 0 to < 1.76.6affected
  • 1.76.6unaffected

ECOVACS DEEBOT X2 COMBO

Default version status: unknown

  • 0 to < 1.81.10affected
  • 1.81.10unaffected

ECOVACS DEEBOT X5 PRO ULTRA

Default version status: unknown

  • 0 to < 1.17.0affected
  • 1.17.0unaffected

References