Low severity · published Jan 23, 2025
CVE-2024-52328
ECOVACS lawnmowers and vacuums insecurely store audio warning files
2.3
CVSS
0.2%
EPSS
No
On KEV
Description
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Unspecified robots · ECOVACS
All versions, or not specified · source: vendor
AA
Airbot Andy Firmware · Ecovacs
All versions, or not specified · source: NVD
AA
Airbot Ava Firmware · Ecovacs
All versions, or not specified · source: NVD
AZ
Airbot Z1 Firmware · Ecovacs
All versions, or not specified · source: NVD
D9
Deebot 900 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N10 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N8 Firmware · Ecovacs
All versions, or not specified · source: NVD
DN
Deebot N9 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T10 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T20 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T8 Firmware · Ecovacs
All versions, or not specified · source: NVD
DT
Deebot T9 Firmware · Ecovacs
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52328
Exploit
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
Exploit
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
More from Unspecified robots
7.6
CVE-2024-11147
ECOVACS lawnmowers and vacuums deterministic root password
7.5
CVE-2024-52331
ECOVACS lawnmowers and vacuums deterministic firmware encryption key
6.3
CVE-2024-12078
ECOVACS lawnmowers and vacuums static BLE GATT encryption key
3.3
CVE-2024-12079
ECOVACS lawnmowers cleartext storage of anti-theft PIN