{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report ",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov"
    },
    "title": "ECOVACS lawnmower and vacuum vulnerabilities",
    "tracking": {
      "current_release_date": "2025-01-23T00:53:24Z",
      "generator": {
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.17"
        },
        "date": "2025-01-24T03:45:51Z"
      },
      "id": "VA-25-022-01",
      "initial_release_date": "2025-01-23T00:53:24Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-01-22T00:00:00Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Suzhou, China",
        "title": "Company Headquarters Location",
        "category": "other"
      },
      {
        "text": "None",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "ECOVACS lawnmowers, vacuums, and other robots contain multiple vulnerabilities. In some cases, using a combination of vulnerabilities, an attacker within Bluetooth range or with appropriate network access can take complete control of a robot device. Some vulnerabilities allow an attacker to access device cameras and microphones. Note that the list of affected products is incomplete.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "title": "Recommended Practices",
        "category": "general",
        "text": "Review ECOVACS advisories and update robot firmware and mobile apps."
      }
    ],
    "references": [
      {
        "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2025/va-25-022-01.json",
        "summary": "Vulnerability Advisory VA-25-022-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ECOVACS",
        "branches": [
          {
            "category": "product_name",
            "name": "AIRBOT Z1",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "ECOVACS AIRBOT Z1 *",
                  "product_id": "CSAFPID-0001"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "cloud service",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<2024-12-17",
                "product": {
                  "name": "ECOVACS cloud service 0 < 2024-12-17",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "2024-12-17",
                "product": {
                  "name": "ECOVACS cloud service 2024-12-17",
                  "product_id": "CSAFPID-0003"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT N30 OMNI",
            "branches": [
              {
                "category": "product_version",
                "product": {
                  "name": "ECOVACS DEEBOT N30 OMNI *",
                  "product_id": "CSAFPID-0004"
                },
                "name": "vers:all/*"
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT N30 PRO OMNI",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "ECOVACS DEEBOT N30 PRO OMNI *",
                  "product_id": "CSAFPID-0005"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T10",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.7.5",
                "product": {
                  "name": "ECOVACS DEEBOT T10 0 < 1.7.5",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "1.7.5",
                "product": {
                  "name": "ECOVACS DEEBOT T10 1.7.5",
                  "product_id": "CSAFPID-0007"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T10 OMNI",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.9.0",
                "product": {
                  "name": "ECOVACS DEEBOT T10 OMNI 0 < 1.9.0",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version",
                "name": "1.9.0",
                "product": {
                  "name": "ECOVACS DEEBOT T10 OMNI 1.9.0",
                  "product_id": "CSAFPID-0009"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T10 PLUS",
            "branches": [
              {
                "category": "product_version",
                "name": "1.7.5",
                "product": {
                  "name": "ECOVACS DEEBOT T10 PLUS 1.7.5",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.7.5",
                "product": {
                  "name": "ECOVACS DEEBOT T10 PLUS 0 < 1.7.5",
                  "product_id": "CSAFPID-0011"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T10 TURBO",
            "branches": [
              {
                "category": "product_version",
                "name": "1.10.0",
                "product": {
                  "name": "ECOVACS DEEBOT T10 TURBO 1.10.0",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.10.0",
                "product": {
                  "name": "ECOVACS DEEBOT T10 TURBO 0 < 1.10.0",
                  "product_id": "CSAFPID-0013"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T30 OMNI",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.93.0",
                "product": {
                  "name": "ECOVACS DEEBOT T30 OMNI 0 < 1.93.0",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version",
                "name": "1.93.0",
                "product": {
                  "name": "ECOVACS DEEBOT T30 OMNI 1.93.0",
                  "product_id": "CSAFPID-0015"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT T30S",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.95.0",
                "product": {
                  "name": "ECOVACS DEEBOT T30S 0 < 1.95.0",
                  "product_id": "CSAFPID-0016"
                }
              },
              {
                "category": "product_version",
                "name": "1.95.0",
                "product": {
                  "name": "ECOVACS DEEBOT T30S 1.95.0",
                  "product_id": "CSAFPID-0017"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1",
            "branches": [
              {
                "category": "product_version",
                "name": "1.7.3",
                "product": {
                  "name": "ECOVACS DEEBOT X1 1.7.3",
                  "product_id": "CSAFPID-0018"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.7.3",
                "product": {
                  "name": "ECOVACS DEEBOT X1 0 < 1.7.3",
                  "product_id": "CSAFPID-0019"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1e OMNI",
            "branches": [
              {
                "category": "product_version",
                "name": "2.4.42",
                "product": {
                  "name": "ECOVACS DEEBOT X1e OMNI 2.4.42",
                  "product_id": "CSAFPID-0020"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.4.42",
                "product": {
                  "name": "ECOVACS DEEBOT X1e OMNI 0 < 2.4.42",
                  "product_id": "CSAFPID-0021"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1 OMNI",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 OMNI 0 < 2.4.41",
                  "product_id": "CSAFPID-0022"
                }
              },
              {
                "category": "product_version",
                "name": "2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 OMNI 2.4.41",
                  "product_id": "CSAFPID-0023"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1 PLUS",
            "branches": [
              {
                "category": "product_version",
                "name": "1.7.3",
                "product": {
                  "name": "ECOVACS DEEBOT X1 PLUS 1.7.3",
                  "product_id": "CSAFPID-0024"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.7.3",
                "product": {
                  "name": "ECOVACS DEEBOT X1 PLUS 0 < 1.7.3",
                  "product_id": "CSAFPID-0025"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1 PRO OMNI",
            "branches": [
              {
                "category": "product_version",
                "name": "2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 PRO OMNI 2.4.41",
                  "product_id": "CSAFPID-0026"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 PRO OMNI 0 < 2.4.41",
                  "product_id": "CSAFPID-0027"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1S PRO",
            "branches": [
              {
                "category": "product_version",
                "name": "2.5.31",
                "product": {
                  "name": "ECOVACS DEEBOT X1S PRO 2.5.31",
                  "product_id": "CSAFPID-0028"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.5.31",
                "product": {
                  "name": "ECOVACS DEEBOT X1S PRO 0 < 2.5.31",
                  "product_id": "CSAFPID-0029"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1S PRO PLUS",
            "branches": [
              {
                "category": "product_version",
                "name": "1.23.0",
                "product": {
                  "name": "ECOVACS DEEBOT X1S PRO PLUS 1.23.0",
                  "product_id": "CSAFPID-0030"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.23.0",
                "product": {
                  "name": "ECOVACS DEEBOT X1S PRO PLUS 0 < 1.23.0",
                  "product_id": "CSAFPID-0031"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X1 TURBO",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 TURBO 0 < 2.4.41",
                  "product_id": "CSAFPID-0032"
                }
              },
              {
                "category": "product_version",
                "name": "2.4.41",
                "product": {
                  "name": "ECOVACS DEEBOT X1 TURBO 2.4.41",
                  "product_id": "CSAFPID-0033"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X2 COMBO",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.81.10",
                "product": {
                  "name": "ECOVACS DEEBOT X2 COMBO 0 < 1.81.10",
                  "product_id": "CSAFPID-0034"
                }
              },
              {
                "category": "product_version",
                "name": "1.81.10",
                "product": {
                  "name": "ECOVACS DEEBOT X2 COMBO 1.81.10",
                  "product_id": "CSAFPID-0035"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X2  OMNI",
            "branches": [
              {
                "category": "product_version",
                "name": "1.76.6",
                "product": {
                  "name": "ECOVACS DEEBOT X2  OMNI 1.76.6",
                  "product_id": "CSAFPID-0036"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.76.6",
                "product": {
                  "name": "ECOVACS DEEBOT X2  OMNI 0 < 1.76.6",
                  "product_id": "CSAFPID-0037"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X2 PRO",
            "branches": [
              {
                "category": "product_version",
                "name": "1.76.6",
                "product": {
                  "name": "ECOVACS DEEBOT X2 PRO 1.76.6",
                  "product_id": "CSAFPID-0038"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.76.6",
                "product": {
                  "name": "ECOVACS DEEBOT X2 PRO 0 < 1.76.6",
                  "product_id": "CSAFPID-0039"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X2S",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.49.0",
                "product": {
                  "name": "ECOVACS DEEBOT X2S 0 < 1.49.0",
                  "product_id": "CSAFPID-0040"
                }
              },
              {
                "category": "product_version",
                "name": "1.49.0",
                "product": {
                  "name": "ECOVACS DEEBOT X2S 1.49.0",
                  "product_id": "CSAFPID-0041"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X5 PRO",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.70.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO 0 < 1.70.0",
                  "product_id": "CSAFPID-0042"
                }
              },
              {
                "category": "product_version",
                "name": "1.70.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO 1.70.0",
                  "product_id": "CSAFPID-0043"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X5 PRO PLUS",
            "branches": [
              {
                "category": "product_version",
                "name": "1.38.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO PLUS 1.38.0",
                  "product_id": "CSAFPID-0044"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.38.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO PLUS 0 < 1.38.0",
                  "product_id": "CSAFPID-0045"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEEBOT X5 PRO ULTRA",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.17.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO ULTRA 0 < 1.17.0",
                  "product_id": "CSAFPID-0046"
                }
              },
              {
                "category": "product_version",
                "name": "1.17.0",
                "product": {
                  "name": "ECOVACS DEEBOT X5 PRO ULTRA 1.17.0",
                  "product_id": "CSAFPID-0047"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "ECOVACS HOME",
            "branches": [
              {
                "category": "product_version",
                "name": "3.0.0",
                "product": {
                  "name": "ECOVACS ECOVACS HOME 3.0.0",
                  "product_id": "CSAFPID-0048"
                }
              },
              {
                "category": "product_version_range",
                "name": "<3.0.0",
                "product": {
                  "name": "ECOVACS ECOVACS HOME 0 < 3.0.0",
                  "product_id": "CSAFPID-0049"
                }
              },
              {
                "category": "product_version_range",
                "name": "<3.0.2",
                "product": {
                  "name": "ECOVACS ECOVACS HOME 0 < 3.0.2",
                  "product_id": "CSAFPID-0050"
                }
              },
              {
                "category": "product_version",
                "name": "3.0.2",
                "product": {
                  "name": "ECOVACS ECOVACS HOME 3.0.2",
                  "product_id": "CSAFPID-0051"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "GOAT G1",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1 0 < 1.36.187",
                  "product_id": "CSAFPID-0052"
                }
              },
              {
                "category": "product_version",
                "name": "1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1 1.36.187",
                  "product_id": "CSAFPID-0053"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "GOAT G1-2000",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1-2000 0 < 1.36.187",
                  "product_id": "CSAFPID-0054"
                }
              },
              {
                "category": "product_version",
                "name": "1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1-2000 1.36.187",
                  "product_id": "CSAFPID-0055"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "GOAT G1-800",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1-800 0 < 1.36.187",
                  "product_id": "CSAFPID-0056"
                }
              },
              {
                "category": "product_version",
                "name": "1.36.187",
                "product": {
                  "name": "ECOVACS GOAT G1-800 1.36.187",
                  "product_id": "CSAFPID-0057"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "GOAT GX-600",
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.120",
                "product": {
                  "name": "ECOVACS GOAT GX-600 0 < 1.2.120",
                  "product_id": "CSAFPID-0058"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.120",
                "product": {
                  "name": "ECOVACS GOAT GX-600 1.2.120",
                  "product_id": "CSAFPID-0059"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "Mate X",
            "branches": [
              {
                "category": "product_version",
                "name": "1.44.18",
                "product": {
                  "name": "ECOVACS Mate X 1.44.18",
                  "product_id": "CSAFPID-0060"
                }
              },
              {
                "category": "product_version_range",
                "name": "<1.44.18",
                "product": {
                  "name": "ECOVACS Mate X 0 < 1.44.18",
                  "product_id": "CSAFPID-0061"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "Unspecified robots",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "ECOVACS Unspecified robots *",
                  "product_id": "CSAFPID-0062"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-52325",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over unauthenticated BLE connection.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2024-11-21T21:30:52Z/"
        }
      ],
      "title": "ECOVACS robot lawnmowers and vacuums command injection",
      "product_status": {
        "known_affected": [
          "CSAFPID-0052",
          "CSAFPID-0056",
          "CSAFPID-0040",
          "CSAFPID-0042",
          "CSAFPID-0045",
          "CSAFPID-0014",
          "CSAFPID-0016",
          "CSAFPID-0054",
          "CSAFPID-0058",
          "CSAFPID-0037",
          "CSAFPID-0034",
          "CSAFPID-0046"
        ],
        "fixed": [
          "CSAFPID-0053",
          "CSAFPID-0057",
          "CSAFPID-0041",
          "CSAFPID-0043",
          "CSAFPID-0044",
          "CSAFPID-0015",
          "CSAFPID-0017",
          "CSAFPID-0055",
          "CSAFPID-0059",
          "CSAFPID-0036",
          "CSAFPID-0035",
          "CSAFPID-0047"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf"
        },
        {
          "category": "external",
          "summary": "youtu.be",
          "url": "https://youtu.be/_wUsM0Mlenc?t=2041"
        },
        {
          "category": "external",
          "summary": "www.ecovacs.com",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001"
        },
        {
          "category": "external",
          "summary": "www.ecovacs.com",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0052",
            "CSAFPID-0056",
            "CSAFPID-0040",
            "CSAFPID-0042",
            "CSAFPID-0045",
            "CSAFPID-0014",
            "CSAFPID-0016",
            "CSAFPID-0054",
            "CSAFPID-0058",
            "CSAFPID-0037",
            "CSAFPID-0034",
            "CSAFPID-0046"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0052"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0053"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0056"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0057"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.49.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0040"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.49.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0041"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.70.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0042"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.70.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0043"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.38.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0045"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.38.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0044"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.93.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0014"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.93.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0015"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.95.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0016"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.95.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0017"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0054"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.36.187.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0055"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.2.120.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0058"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.2.120.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241130001",
          "product_ids": [
            "CSAFPID-0059"
          ],
          "date": "2024-11-30T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0037"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0036"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.81.10.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0034"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.81.10.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0035"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.17.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0046"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released firmware version 1.17.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241119",
          "product_ids": [
            "CSAFPID-0047"
          ],
          "date": "2024-11-19T06:00:00Z"
        },
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0005"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese",
            "Braelynn Luedtke",
            "Chris Anderson"
          ]
        }
      ],
      "release_date": "2024-08-11T00:00:00Z"
    },
    {
      "cve": "CVE-2024-52328",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:P/2024-11-21T21:44:10Z/"
        }
      ],
      "title": "ECOVACS lawnmowers and vacuums insecurely store audio warning files",
      "product_status": {
        "known_affected": [
          "CSAFPID-0062"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0062"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Any ECOVACS robot with a camera is likely to be affected.",
          "product_ids": [
            "CSAFPID-0062"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Braelynn Luedtke"
          ]
        },
        {
          "names": [
            "Dennis Giese"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-52329",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2025-01-16T20:12:16Z/"
        }
      ],
      "title": "ECOVACS HOME mobile app plugins do not properly validate TLS certificates",
      "product_status": {
        "known_affected": [
          "CSAFPID-0049"
        ],
        "fixed": [
          "CSAFPID-0048"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        },
        {
          "category": "external",
          "summary": "www.ecovacs.com",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0049"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "ECOVACS released version 3.0.0 of the ECOVACS HOME app. ECOVACS may have updated plugins for specific robots.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0048"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS released version 3.0.0 of the ECOVACS HOME app. ECOVACS may have updated plugins for specific robots.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0049"
          ],
          "date": "2024-12-17T06:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-52330",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2024-11-22T17:08:48Z/"
        }
      ],
      "title": "ECOVACS lawnmowers and vacuums do not properly validate TLS certificates",
      "product_status": {
        "known_affected": [
          "CSAFPID-0045",
          "CSAFPID-0042",
          "CSAFPID-0040",
          "CSAFPID-0037",
          "CSAFPID-0032",
          "CSAFPID-0019",
          "CSAFPID-0029",
          "CSAFPID-0021",
          "CSAFPID-0011",
          "CSAFPID-0008",
          "CSAFPID-0046",
          "CSAFPID-0061",
          "CSAFPID-0039",
          "CSAFPID-0034",
          "CSAFPID-0022",
          "CSAFPID-0027",
          "CSAFPID-0025",
          "CSAFPID-0031",
          "CSAFPID-0013",
          "CSAFPID-0006"
        ],
        "fixed": [
          "CSAFPID-0044",
          "CSAFPID-0043",
          "CSAFPID-0041",
          "CSAFPID-0036",
          "CSAFPID-0033",
          "CSAFPID-0018",
          "CSAFPID-0028",
          "CSAFPID-0020",
          "CSAFPID-0010",
          "CSAFPID-0009",
          "CSAFPID-0047",
          "CSAFPID-0060",
          "CSAFPID-0038",
          "CSAFPID-0035",
          "CSAFPID-0023",
          "CSAFPID-0026",
          "CSAFPID-0024",
          "CSAFPID-0030",
          "CSAFPID-0012",
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        },
        {
          "category": "external",
          "summary": "www.ecovacs.com",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0045",
            "CSAFPID-0042",
            "CSAFPID-0040",
            "CSAFPID-0037",
            "CSAFPID-0032",
            "CSAFPID-0019",
            "CSAFPID-0029",
            "CSAFPID-0021",
            "CSAFPID-0011",
            "CSAFPID-0008",
            "CSAFPID-0046",
            "CSAFPID-0061",
            "CSAFPID-0039",
            "CSAFPID-0034",
            "CSAFPID-0022",
            "CSAFPID-0027",
            "CSAFPID-0025",
            "CSAFPID-0031",
            "CSAFPID-0013",
            "CSAFPID-0006"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.38.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0044"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.38.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0045"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.70.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0043"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.70.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0042"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.49.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0040"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.49.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0041"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0036"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0037"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0032"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0033"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.3.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0018"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.3.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0019"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.5.31.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0028"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.5.31.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0029"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.42.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0020"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.42.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0021"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.5.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.5.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.9.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.9.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.17.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0046"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.17.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0047"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.44.18.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0060"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.44.18.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0061"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0038"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.76.6.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0039"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.81.10.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0034"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.81.10.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0035"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0022"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0023"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0026"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 2.4.41.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0027"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.3.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0024"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.3.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.23.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0030"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.23.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0031"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.10.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.10.0.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.5.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS has released firmware version 1.7.5.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217001",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2024-12-17T06:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-52331",
      "cwe": {
        "id": "CWE-494",
        "name": "Download of Code Without Integrity Check"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2024-11-22T17:18:33Z/"
        }
      ],
      "title": "ECOVACS lawnmowers and vacuums deterministic firmware encryption key",
      "product_status": {
        "known_affected": [
          "CSAFPID-0062"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0062"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0062"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-11147",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2024-11-25T16:55:39Z/"
        }
      ],
      "title": "ECOVACS lawnmowers and vacuums deterministic root password",
      "product_status": {
        "known_affected": [
          "CSAFPID-0062"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        },
        {
          "category": "external",
          "summary": "builder.dontvacuum.me",
          "url": "https://builder.dontvacuum.me/ecopassword.php"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0062"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0062"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-12078",
      "cwe": {
        "id": "CWE-321",
        "name": "Use of Hard-coded Cryptographic Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:P/2025-01-23T00:08:15Z/"
        }
      ],
      "title": "ECOVACS lawnmowers and vacuums static BLE GATT encryption key",
      "product_status": {
        "known_affected": [
          "CSAFPID-0062"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        },
        {
          "category": "external",
          "summary": "youtu.be",
          "url": "https://youtu.be/_wUsM0Mlenc?t=2041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0062"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0062"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-12079",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:P/2025-01-23T00:29:20Z/"
        }
      ],
      "title": "ECOVACS lawnmowers cleartext storage of anti-theft PIN",
      "product_status": {
        "known_affected": [
          "CSAFPID-0062"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0062"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Unknown.",
          "product_ids": [
            "CSAFPID-0062"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    },
    {
      "cve": "CVE-2024-52327",
      "cwe": {
        "id": "CWE-603",
        "name": "Use of Client-Side Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:P/2025-01-15T20:26:52Z/"
        }
      ],
      "title": "ECOVACS lawnmower and vacuum cloud service live video PIN bypass",
      "product_status": {
        "known_affected": [
          "CSAFPID-0050",
          "CSAFPID-0002"
        ],
        "fixed": [
          "CSAFPID-0051",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
        },
        {
          "category": "external",
          "summary": "www.ecovacs.com",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0050",
            "CSAFPID-0002"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "ECOVACS updated the cloud service and ECOVACS HOME mobile apps.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002",
          "product_ids": [
            "CSAFPID-0050"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS updated the cloud service and ECOVACS HOME mobile apps.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002",
          "product_ids": [
            "CSAFPID-0051"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS updated the cloud service and ECOVACS HOME mobile apps.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2024-12-17T06:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "ECOVACS updated the cloud service and ECOVACS HOME mobile apps.",
          "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2024-12-17T06:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "release_date": "2023-12-27T00:00:00Z"
    }
  ]
}