Deebot X1 Firmware vulnerabilities

3 known vulnerabilities in Deebot X1 Firmware from Ecovacs. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Unspecified robots: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2024-52331Jan 23, 2025Ecovacs

  ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

• 7.4 High severity

  DEEBOT X5 PRO PLUS: Improper Certificate Validation

  CVE-2024-52330Jan 23, 2025Ecovacs

  ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

• 7.6 High severity

  Unspecified robots: Use of Hard-coded Credentials

  CVE-2024-11147Jan 23, 2025Ecovacs

  ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.