Vulnerability · Published Jan 23, 2025 · Assigned by cisa-cg
CVE-2024-52327ECOVACS lawnmower and vacuum cloud service live video PIN bypass
Medium 6.5
In plain English
A medium-severity security flaw in cloud service from ECOVACS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 58.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ECOVACS | ECOVACS HOME | 0 – before 3.0.2 |
| ECOVACS | cloud service | 0 – before 2024-12-17 |
Weakness: CWE-603, CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N