CVE-2024-52329

HIGH

ECOVACS HOME < 3.0.0 - Unauthenticated TLS Certificate Validation Bypass

Title source: llm
STIX 2.1

Description

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

References (3)

Core 3

Scores

CVSS v3 7.4
EPSS 0.0035
EPSS Percentile 26.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-295
Status published
Products (1)
ecovacs/home < 3.0.0 (2 CPE variants)
Published Jan 23, 2025
Tracked Since Feb 18, 2026