Description
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
Scores
CVSS v3
7.2
EPSS
0.0003
EPSS Percentile
8.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-494
Status
published
Products (13)
ecovacs/deebot_t10_firmware
< 1.11.0
ecovacs/deebot_t10_omni_firmware
< 1.11.0
ecovacs/deebot_t10_plus_firmware
< 1.11.0
ecovacs/deebot_t10_turbo_firmware
< 1.11.0
ecovacs/deebot_t20_omni_firmware
< 1.25.0
ecovacs/deebot_t20_pro_firmware
< 1.25.0
ecovacs/deebot_t20_pro_plus_firmware
< 1.25.0
ecovacs/deebot_t30_omni_firmware
< 1.100.0
ecovacs/deebot_t30s_firmware
< 1.100.0
ecovacs/deebot_x1_omni_firmware
< 2.4.45
... and 3 more
Published
Sep 05, 2025
Tracked Since
Feb 18, 2026