Vulnerability · Published Jan 23, 2025 · Assigned by cisa-cg
CVE-2024-52329ECOVACS HOME mobile app plugins do not properly validate TLS certificates
High 7.4
In plain English
A high-severity improper certificate validation in ECOVACS HOME from ECOVACS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 67.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ECOVACS | ECOVACS HOME | 0 – before 3.0.0 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N