Medium severity · published Jan 23, 2025
CVE-2024-52327
ECOVACS lawnmower and vacuum cloud service live video PIN bypass
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EH
ECOVACS HOME · ECOVACS
before 3.0.2 · source: vendor
CS
cloud service · ECOVACS
before 2024-12-17 · source: vendor
HO
Home · Ecovacs
before 3.0.2; before 3.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52327
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52327
Exploit
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
Exploit
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
Vendor Advisory
https://www.ecovacs.com/global/userhelp/dsa20241217002