CVE-2024-11147

HIGH

ECOVACS Robot Lawnmowers and Vacuums - Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Description

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

References (3)

Core 3

Scores

CVSS v3 7.6
EPSS 0.0038
EPSS Percentile 29.3%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-798
Status published
Products (14)
ecovacs/airbot_andy_firmware
ecovacs/airbot_ava_firmware
ecovacs/airbot_z1_firmware
ecovacs/deebot_900_firmware
ecovacs/deebot_n10_firmware
ecovacs/deebot_n8_firmware
ecovacs/deebot_n9_firmware
ecovacs/deebot_t10_firmware
ecovacs/deebot_t20_firmware
ecovacs/deebot_t8_firmware
... and 4 more
Published Jan 23, 2025
Tracked Since Feb 18, 2026