7.6
CVE-2024-11147
- EPSS 0.4%
- Veröffentlicht 23.01.2025 17:15:12
- Zuletzt bearbeitet 23.09.2025 17:44:13
- Erkennungen
LoginECOVACS lawnmowers and vacuums deterministic root password
ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ecovacs ≫ Deebot 900 Firmware Version -
Ecovacs ≫ Deebot N8 Firmware Version -
Ecovacs ≫ Deebot T8 Firmware Version -
Ecovacs ≫ Deebot N9 Firmware Version -
Ecovacs ≫ Deebot T9 Firmware Version -
Ecovacs ≫ Deebot N10 Firmware Version -
Ecovacs ≫ Deebot T10 Firmware Version -
Ecovacs ≫ Deebot X1 Firmware Version -
Ecovacs ≫ Deebot T20 Firmware Version -
Ecovacs ≫ Deebot X2 Firmware Version -
Ecovacs ≫ Goat G1 Firmware Version -
Ecovacs ≫ Airbot Z1 Firmware Version -
Ecovacs ≫ Airbot Ava Firmware Version -
Ecovacs ≫ Airbot Andy Firmware Version -
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.333 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cisa-cg | 7 | 0 | 0 |
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| cisa-cg | 7.6 | 0.9 | 6 |
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
CWE-798 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
https://builder.dontvacuum.me/ecopassword.php
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf