{"id":"CVE-2024-52330","state":"PUBLISHED","title":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates","description":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.","publishedAt":"2025-01-23T16:36:50.128Z","updatedAt":"2025-02-12T20:41:28.969Z","severity":{"score":9.5,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","source":"cisa-cg"},"assigner":"cisa-cg","products":["ECOVACS DEEBOT X5 PRO PLUS","ECOVACS DEEBOT X5 PRO","ECOVACS DEEBOT X2S","ECOVACS DEEBOT X2  OMNI","ECOVACS DEEBOT X1 TURBO","ECOVACS DEEBOT X1","ECOVACS DEEBOT X1S PRO","ECOVACS DEEBOT X1e OMNI","ECOVACS DEEBOT T10 PLUS","ECOVACS DEEBOT T10 OMNI","ECOVACS DEEBOT X5 PRO ULTRA","ECOVACS Mate X","ECOVACS DEEBOT X2 PRO","ECOVACS DEEBOT X2 COMBO","ECOVACS DEEBOT X1 OMNI","ECOVACS DEEBOT X1 PRO OMNI","ECOVACS DEEBOT X1 PLUS","ECOVACS DEEBOT X1S PRO PLUS","ECOVACS DEEBOT T10 TURBO","ECOVACS DEEBOT T10"],"affected":[{"vendor":"ECOVACS","product":"DEEBOT X5 PRO PLUS","defaultStatus":"unknown","versions":[{"version":"1.38.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.38.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X5 PRO","defaultStatus":"unknown","versions":[{"version":"1.70.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.70.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2S","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.49.0","versionType":"custom"},{"version":"1.49.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X2  OMNI","defaultStatus":"unknown","versions":[{"version":"1.76.6","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.76.6","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 TURBO","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"},{"version":"2.4.41","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1","defaultStatus":"unknown","versions":[{"version":"1.7.3","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.3","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1S PRO","defaultStatus":"unknown","versions":[{"version":"2.5.31","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.5.31","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1e OMNI","defaultStatus":"unknown","versions":[{"version":"2.4.42","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.4.42","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 PLUS","defaultStatus":"unknown","versions":[{"version":"1.7.5","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.5","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 OMNI","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.9.0","versionType":"custom"},{"version":"1.9.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X5 PRO ULTRA","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.17.0","versionType":"custom"},{"version":"1.17.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"Mate X","defaultStatus":"unknown","versions":[{"version":"1.44.18","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.44.18","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2 PRO","defaultStatus":"unknown","versions":[{"version":"1.76.6","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.76.6","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2 COMBO","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.81.10","versionType":"custom"},{"version":"1.81.10","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 OMNI","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"},{"version":"2.4.41","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 PRO OMNI","defaultStatus":"unknown","versions":[{"version":"2.4.41","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 PLUS","defaultStatus":"unknown","versions":[{"version":"1.7.3","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.3","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1S PRO PLUS","defaultStatus":"unknown","versions":[{"version":"1.23.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.23.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 TURBO","defaultStatus":"unknown","versions":[{"version":"1.10.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.10.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.7.5","versionType":"custom"},{"version":"1.7.5","status":"unaffected"}]}],"references":["https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf","https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf","https://www.ecovacs.com/global/userhelp/dsa20241217001"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/52xxx/CVE-2024-52330.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-52330","state":"PUBLISHED","datePublished":"2025-01-23T16:36:50.128Z","dateUpdated":"2025-02-12T20:41:28.969Z","assignerShortName":"cisa-cg","assignerOrgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateReserved":"2024-11-08T01:06:02.405Z"},"containers":{"cna":{"title":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates","descriptions":[{"lang":"en","value":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates."}],"affected":[{"vendor":"ECOVACS","product":"DEEBOT X5 PRO PLUS","defaultStatus":"unknown","versions":[{"version":"1.38.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.38.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X5 PRO","defaultStatus":"unknown","versions":[{"version":"1.70.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.70.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2S","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.49.0","versionType":"custom"},{"version":"1.49.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X2  OMNI","defaultStatus":"unknown","versions":[{"version":"1.76.6","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.76.6","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 TURBO","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"},{"version":"2.4.41","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1","defaultStatus":"unknown","versions":[{"version":"1.7.3","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.3","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1S PRO","defaultStatus":"unknown","versions":[{"version":"2.5.31","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.5.31","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1e OMNI","defaultStatus":"unknown","versions":[{"version":"2.4.42","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.4.42","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 PLUS","defaultStatus":"unknown","versions":[{"version":"1.7.5","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.5","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 OMNI","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.9.0","versionType":"custom"},{"version":"1.9.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X5 PRO ULTRA","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.17.0","versionType":"custom"},{"version":"1.17.0","status":"unaffected"}]},{"vendor":"ECOVACS","product":"Mate X","defaultStatus":"unknown","versions":[{"version":"1.44.18","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.44.18","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2 PRO","defaultStatus":"unknown","versions":[{"version":"1.76.6","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.76.6","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X2 COMBO","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.81.10","versionType":"custom"},{"version":"1.81.10","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 OMNI","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"},{"version":"2.4.41","status":"unaffected"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 PRO OMNI","defaultStatus":"unknown","versions":[{"version":"2.4.41","status":"unaffected"},{"version":"0","status":"affected","lessThan":"2.4.41","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1 PLUS","defaultStatus":"unknown","versions":[{"version":"1.7.3","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.7.3","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT X1S PRO PLUS","defaultStatus":"unknown","versions":[{"version":"1.23.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.23.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10 TURBO","defaultStatus":"unknown","versions":[{"version":"1.10.0","status":"unaffected"},{"version":"0","status":"affected","lessThan":"1.10.0","versionType":"custom"}]},{"vendor":"ECOVACS","product":"DEEBOT T10","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.7.5","versionType":"custom"},{"version":"1.7.5","status":"unaffected"}]}],"references":[{"url":"https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf","name":"url"},{"url":"https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf","name":"url"},{"url":"https://www.ecovacs.com/global/userhelp/dsa20241217001","name":"url"}],"metrics":[{"cvssV3_1":{"baseScore":7.4,"baseSeverity":"HIGH","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"format":"CVSS"},{"cvssV4_0":{"baseScore":9.5,"baseSeverity":"CRITICAL","version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"CWE-295 Improper Certificate Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisa-cg","orgId":"9119a7d8-5eab-497f-8521-727c672e3725","dateUpdated":"2025-01-23T16:36:50.128Z"},"datePublic":"2023-12-27T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-52330","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-01-23T16:56:31.855219Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T20:41:28.969Z"}}]}}}