9.5

CVE-2024-52330

Exploit

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ecovacs ≫ Deebot X2 Omni Firmware Version < 1.76.6
   Ecovacs ≫ Deebot X2 Omni Version -
Ecovacs ≫ Deebot X2 Combo Firmware Version < 1.81.10
   Ecovacs ≫ Deebot X2 Combo Version -
Ecovacs ≫ Deebot X2s Firmware Version < 1.49.0
   Ecovacs ≫ Deebot X2s Version -
Ecovacs ≫ Deebot X5 Pro Firmware Version < 1.70.0
   Ecovacs ≫ Deebot X5 Pro Version -
Ecovacs ≫ Deebot X5 Pro Plus Firmware Version < 1.38.0
   Ecovacs ≫ Deebot X5 Pro Plus Version -
Ecovacs ≫ Deebot X5 Pro Ultra Firmware Version < 1.17.0
   Ecovacs ≫ Deebot X5 Pro Ultra Version -
Ecovacs ≫ Mate X Firmware Version < 1.44.18
   Ecovacs ≫ Mate X Version -
Ecovacs ≫ Deebot X1 Omni Firmware Version < 2.4.41
   Ecovacs ≫ Deebot X1 Omni Version -
Ecovacs ≫ Deebot X1 Turbo Firmware Version < 2.4.41
   Ecovacs ≫ Deebot X1 Turbo Version -
Ecovacs ≫ Deebot X1 Pro Omni Firmware Version < 2.4.41
   Ecovacs ≫ Deebot X1 Pro Omni Version -
Ecovacs ≫ Deebot X1 Firmware Version < 1.7.3
   Ecovacs ≫ Deebot X1 Version -
Ecovacs ≫ Deebot X1 Plus Firmware Version < 1.7.3
   Ecovacs ≫ Deebot X1 Plus Version -
Ecovacs ≫ Deebot X1s Pro Firmware Version < 2.5.31
   Ecovacs ≫ Deebot X1s Pro Version -
Ecovacs ≫ Deebot X1s Pro Plus Firmware Version < 1.23.0
   Ecovacs ≫ Deebot X1s Pro Plus Version -
Ecovacs ≫ Deebot X1e Omni Firmware Version < 2.4.42
   Ecovacs ≫ Deebot X1e Omni Version -
Ecovacs ≫ Deebot T10 Turbo Firmware Version < 1.10.0
   Ecovacs ≫ Deebot T10 Turbo Version -
Ecovacs ≫ Deebot T10 Plus Firmware Version < 1.7.5
   Ecovacs ≫ Deebot T10 Plus Version -
Ecovacs ≫ Deebot T10 Firmware Version < 1.7.5
   Ecovacs ≫ Deebot T10 Version -
Ecovacs ≫ Deebot T10 Omni Firmware Version < 1.9.0
   Ecovacs ≫ Deebot T10 Omni Version -
Ecovacs ≫ Deebot X2 Pro Firmware Version < 1.76.6
   Ecovacs ≫ Deebot X2 Pro Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.277
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cisa-cg 9.5 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cisa-cg 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
Third Party Advisory
Exploit
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
Third Party Advisory
Exploit
https://www.ecovacs.com/global/userhelp/dsa20241217001
Vendor Advisory