Vulnerability · Published Jan 23, 2025 · Assigned by cisa-cg
CVE-2024-52330ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
High 7.4
In plain English
A high-severity improper certificate validation in DEEBOT T10 from ECOVACS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ECOVACS | DEEBOT X5 PRO PLUS | 0 – before 1.38.0 |
| ECOVACS | DEEBOT X5 PRO | 0 – before 1.70.0 |
| ECOVACS | DEEBOT X2S | 0 – before 1.49.0 |
| ECOVACS | DEEBOT X2 OMNI | 0 – before 1.76.6 |
| ECOVACS | DEEBOT X1 TURBO | 0 – before 2.4.41 |
| ECOVACS | DEEBOT X1 | 0 – before 1.7.3 |
| ECOVACS | DEEBOT X1S PRO | 0 – before 2.5.31 |
| ECOVACS | DEEBOT X1e OMNI | 0 – before 2.4.42 |
| ECOVACS | DEEBOT T10 PLUS | 0 – before 1.7.5 |
| ECOVACS | DEEBOT T10 OMNI | 0 – before 1.9.0 |
| ECOVACS | DEEBOT X5 PRO ULTRA | 0 – before 1.17.0 |
| ECOVACS | Mate X | 0 – before 1.44.18 |
| ECOVACS | DEEBOT X2 PRO | 0 – before 1.76.6 |
| ECOVACS | DEEBOT X2 COMBO | 0 – before 1.81.10 |
| ECOVACS | DEEBOT X1 OMNI | 0 – before 2.4.41 |
| ECOVACS | DEEBOT X1 PRO OMNI | 0 – before 2.4.41 |
| ECOVACS | DEEBOT X1 PLUS | 0 – before 1.7.3 |
| ECOVACS | DEEBOT X1S PRO PLUS | 0 – before 1.23.0 |
| ECOVACS | DEEBOT T10 TURBO | 0 – before 1.10.0 |
| ECOVACS | DEEBOT T10 | 0 – before 1.7.5 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N