Vulnerability · Published Jan 23, 2025 · Assigned by cisa-cg
CVE-2024-52325ECOVACS robot lawnmowers and vacuums command injection
Critical 9.6
In plain English
A critical-severity command injection in DEEBOT T30 OMNI from ECOVACS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)3.1%top 12.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ECOVACS | GOAT G1 | 0 – before 1.36.187 |
| ECOVACS | GOAT G1-800 | 0 – before 1.36.187 |
| ECOVACS | DEEBOT X2S | 0 – before 1.49.0 |
| ECOVACS | DEEBOT X5 PRO | 0 – before 1.70.0 |
| ECOVACS | DEEBOT X5 PRO PLUS | 0 – before 1.38.0 |
| ECOVACS | DEEBOT T30 OMNI | 0 – before 1.93.0 |
| ECOVACS | DEEBOT T30S | 0 – before 1.95.0 |
| ECOVACS | GOAT G1-2000 | 0 – before 1.36.187 |
| ECOVACS | GOAT GX-600 | 0 – before 1.2.120 |
| ECOVACS | DEEBOT X2 OMNI | 0 – before 1.76.6 |
| ECOVACS | DEEBOT X2 COMBO | 0 – before 1.81.10 |
| ECOVACS | DEEBOT X5 PRO ULTRA | 0 – before 1.17.0 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H