Low severity · published Jan 23, 2025
CVE-2024-12079
ECOVACS lawnmowers cleartext storage of anti-theft PIN
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Unspecified robots · ECOVACS
All versions, or not specified · source: vendor
AA
Airbot Andy Firmware · Ecovacs
All versions, or not specified · source: NVD
AA
Airbot Ava Firmware · Ecovacs
All versions, or not specified · source: NVD
AZ
Airbot Z1 Firmware · Ecovacs
All versions, or not specified · source: NVD
D9
Deebot 900 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N10 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N8 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N9 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T10 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T20 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T8 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T9 Firmware · Ecovacs
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12079
Exploit
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
More from Unspecified robots
7.6
CVE-2024-11147
ECOVACS lawnmowers and vacuums deterministic root password
7.5
CVE-2024-52331
ECOVACS lawnmowers and vacuums deterministic firmware encryption key
6.3
CVE-2024-12078
ECOVACS lawnmowers and vacuums static BLE GATT encryption key
2.3
CVE-2024-52328
ECOVACS lawnmowers and vacuums insecurely store audio warning files