CVE-2024-52331 - Vulnerability Details

Vendors	Products
Ecovacs	Airbot Andy Airbot Andy Firmware Airbot Ava Airbot Ava Firmware Airbot Z1 Airbot Z1 Firmware Deebot 900 Deebot 900 Firmware Deebot N10 Deebot N10 Firmware Deebot N8 Deebot N8 Firmware Deebot N9 Deebot N9 Firmware Deebot T10 Deebot T10 Firmware Deebot T20 Deebot T20 Firmware Deebot T8 Deebot T8 Firmware Deebot T9 Deebot T9 Firmware Deebot X1 Deebot X1 Firmware Deebot X2 Deebot X2 Firmware Goat G1 Goat G1 Firmware

Link	Providers
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html

Type	Values Removed	Values Added
Weaknesses		CWE-327

Type	Values Removed	Values Added
First Time appeared		Ecovacs Ecovacs airbot Andy Ecovacs airbot Andy Firmware Ecovacs airbot Ava Ecovacs airbot Ava Firmware Ecovacs airbot Z1 Ecovacs airbot Z1 Firmware Ecovacs deebot 900 Ecovacs deebot 900 Firmware Ecovacs deebot N10 Ecovacs deebot N10 Firmware Ecovacs deebot N8 Ecovacs deebot N8 Firmware Ecovacs deebot N9 Ecovacs deebot N9 Firmware Ecovacs deebot T10 Ecovacs deebot T10 Firmware Ecovacs deebot T20 Ecovacs deebot T20 Firmware Ecovacs deebot T8 Ecovacs deebot T8 Firmware Ecovacs deebot T9 Ecovacs deebot T9 Firmware Ecovacs deebot X1 Ecovacs deebot X1 Firmware Ecovacs deebot X2 Ecovacs deebot X2 Firmware Ecovacs goat G1 Ecovacs goat G1 Firmware
CPEs		cpe:2.3:h:ecovacs:airbot_andy:-:::::::* cpe:2.3:h:ecovacs:airbot_ava:-:::::::* cpe:2.3:h:ecovacs:airbot_z1:-:::::::* cpe:2.3:h:ecovacs:deebot_900:-:::::::* cpe:2.3:h:ecovacs:deebot_n10:-:::::::* cpe:2.3:h:ecovacs:deebot_n8:-:::::::* cpe:2.3:h:ecovacs:deebot_n9:-:::::::* cpe:2.3:h:ecovacs:deebot_t10:-:::::::* cpe:2.3:h:ecovacs:deebot_t20:-:::::::* cpe:2.3:h:ecovacs:deebot_t8:-:::::::* cpe:2.3:h:ecovacs:deebot_t9:-:::::::* cpe:2.3:h:ecovacs:deebot_x1:-:::::::* cpe:2.3:h:ecovacs:deebot_x2:-:::::::* cpe:2.3:h:ecovacs:goat_g1:-:::::::* cpe:2.3:o:ecovacs:airbot_andy_firmware:-:::::::* cpe:2.3:o:ecovacs:airbot_ava_firmware:-:::::::* cpe:2.3:o:ecovacs:airbot_z1_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_900_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n10_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n8_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n9_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t10_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t20_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t8_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t9_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_x1_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_x2_firmware:-:::::::* cpe:2.3:o:ecovacs:goat_g1_firmware:-:::::::*
Vendors & Products		Ecovacs Ecovacs airbot Andy Ecovacs airbot Andy Firmware Ecovacs airbot Ava Ecovacs airbot Ava Firmware Ecovacs airbot Z1 Ecovacs airbot Z1 Firmware Ecovacs deebot 900 Ecovacs deebot 900 Firmware Ecovacs deebot N10 Ecovacs deebot N10 Firmware Ecovacs deebot N8 Ecovacs deebot N8 Firmware Ecovacs deebot N9 Ecovacs deebot N9 Firmware Ecovacs deebot T10 Ecovacs deebot T10 Firmware Ecovacs deebot T20 Ecovacs deebot T20 Firmware Ecovacs deebot T8 Ecovacs deebot T8 Firmware Ecovacs deebot T9 Ecovacs deebot T9 Firmware Ecovacs deebot X1 Ecovacs deebot X1 Firmware Ecovacs deebot X2 Ecovacs deebot X2 Firmware Ecovacs goat G1 Ecovacs goat G1 Firmware

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
Title		ECOVACS lawnmowers and vacuums deterministic firmware encryption key
Weaknesses		CWE-1391 CWE-494
References		https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52331", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "state": "PUBLISHED", "assignerShortName": "cisa-cg", "dateReserved": "2024-11-08T01:06:02.405Z", "datePublished": "2025-01-23T16:37:31.290Z", "dateUpdated": "2025-10-02T14:10:10.821Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot."}], "affected": [{"vendor": "ECOVACS", "product": "Unspecified robots", "defaultStatus": "unknown", "versions": [{"version": "*", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE", "cweId": "CWE-494"}]}, {"descriptions": [{"description": "CWE-1391 Use of Weak Credentials", "lang": "en", "type": "CWE", "cweId": "CWE-1391"}]}, {"descriptions": [{"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm", "lang": "en", "type": "CWE", "cweId": "CWE-327"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "title": "ECOVACS lawnmowers and vacuums deterministic firmware encryption key", "references": [{"name": "url", "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html"}, {"name": "url", "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"}], "datePublic": "2025-01-23T00:00:00.000Z", "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2025-10-02T14:10:10.821Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52331", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-23T16:55:20.382490Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:41:28.822Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-52331 (string)

assignerOrgId : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

state : PUBLISHED (string)

assignerShortName : cisa-cg (string)

dateReserved : 2024-11-08T01:06:02.405Z (string)

datePublished : 2025-01-23T16:37:31.290Z (string)

dateUpdated : 2025-10-02T14:10:10.821Z (string)

}

containers : { »

cna : { »

descriptions : [ »

0 : { »

lang : en (string)

value : ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. (string)

}

]

affected : [ »

0 : { »

vendor : ECOVACS (string)

product : Unspecified robots (string)

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : * (string)

status : affected (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : CWE-494 Download of Code Without Integrity Check (string)

lang : en (string)

type : CWE (string)

cweId : CWE-494 (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

description : CWE-1391 Use of Weak Credentials (string)

lang : en (string)

type : CWE (string)

cweId : CWE-1391 (string)

}

]

}

2 : { »

descriptions : [ »

0 : { »

description : CWE-327 Use of a Broken or Risky Cryptographic Algorithm (string)

lang : en (string)

type : CWE (string)

cweId : CWE-327 (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

}

1 : { »

cvssV4_0 : { »

version : 4.0 (string)

baseScore : 7.7 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (string)

userInteraction : PASSIVE (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : HIGH (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

}

]

title : ECOVACS lawnmowers and vacuums deterministic firmware encryption key (string)

references : [ »

0 : { »

name : url (string)

url : https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html (string)

}

1 : { »

name : url (string)

url : https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf (string)

}

]

datePublic : 2025-01-23T00:00:00.000Z (string)

providerMetadata : { »

orgId : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

shortName : cisa-cg (string)

dateUpdated : 2025-10-02T14:10:10.821Z (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-52331 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-01-23T16:55:20.382490Z (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-12T20:41:28.822Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52331", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-23T16:55:20.382490Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:35:29.355Z"}}], "cna": {"title": "ECOVACS lawnmowers and vacuums deterministic firmware encryption key", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ECOVACS", "product": "Unspecified robots", "versions": [{"status": "affected", "version": "*"}], "defaultStatus": "unknown"}], "datePublic": "2025-01-23T00:00:00.000Z", "references": [{"url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html", "name": "url"}, {"url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf", "name": "url"}], "descriptions": [{"lang": "en", "value": "ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1391", "description": "CWE-1391 Use of Weak Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2025-10-02T14:10:10.821Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52331", "state": "PUBLISHED", "dateUpdated": "2025-10-02T14:10:10.821Z", "dateReserved": "2024-11-08T01:06:02.405Z", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "datePublished": "2025-01-23T16:37:31.290Z", "assignerShortName": "cisa-cg"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-52331 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-01-23T16:55:20.382490Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-12T20:35:29.355Z (string)

}

]

cna : { »

title : ECOVACS lawnmowers and vacuums deterministic firmware encryption key (string)

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

}

1 : { »

cvssV4_0 : { »

version : 4.0 (string)

baseScore : 7.7 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (string)

userInteraction : PASSIVE (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : HIGH (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : ECOVACS (string)

product : Unspecified robots (string)

versions : [ »

0 : { »

status : affected (string)

version : * (string)

}

]

defaultStatus : unknown (string)

}

]

datePublic : 2025-01-23T00:00:00.000Z (string)

references : [ »

0 : { »

url : https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html (string)

name : url (string)

}

1 : { »

url : https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf (string)

name : url (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-494 (string)

description : CWE-494 Download of Code Without Integrity Check (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-1391 (string)

description : CWE-1391 Use of Weak Credentials (string)

}

]

}

2 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-327 (string)

description : CWE-327 Use of a Broken or Risky Cryptographic Algorithm (string)

}

]

}

]

providerMetadata : { »

orgId : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

shortName : cisa-cg (string)

dateUpdated : 2025-10-02T14:10:10.821Z (string)

}

cveMetadata : { »

cveId : CVE-2024-52331 (string)

state : PUBLISHED (string)

dateUpdated : 2025-10-02T14:10:10.821Z (string)

dateReserved : 2024-11-08T01:06:02.405Z (string)

assignerOrgId : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

datePublished : 2025-01-23T16:37:31.290Z (string)

assignerShortName : cisa-cg (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_900_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5004D440-E3EE-4252-831B-7396887BA117", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_900:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C4E3255-6E5D-46FC-8DE0-462788F1B4FD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_n8_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "ACB3D3DB-AFB6-4B36-B86D-358BE11FAE3E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_n8:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED77EFA6-576C-411A-91D2-22C962C30C94", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_t8_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "AC59B209-998B-43A6-875D-364844CA37C7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_t8:-:*:*:*:*:*:*:*", "matchCriteriaId": "8BA30BA8-4069-4525-A843-E88EFDC720DF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_n9_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "43C72C62-49C3-49BE-A9F1-3572DA18647C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_n9:-:*:*:*:*:*:*:*", "matchCriteriaId": "7A663879-36BF-433D-9D7A-B62D65A5C6C9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_t9_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D16EB997-ADC3-45AA-8E92-6F1371E85A35", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_t9:-:*:*:*:*:*:*:*", "matchCriteriaId": "D63E5FF5-9A27-4674-B573-6929CAB3BB01", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_n10_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7060D3C-5F7C-4324-987D-C6EB4204CC47", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_n10:-:*:*:*:*:*:*:*", "matchCriteriaId": "DCC67BB7-0E4A-47FA-A04D-41837A18E103", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_t10_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "C7422285-BB34-4D85-A4A4-ADD006401FE7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:*", "matchCriteriaId": "318C962D-54C2-456E-A045-1332A02958E9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_x1_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5248299-76EB-41DB-A036-5685F20D2A18", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_x1:-:*:*:*:*:*:*:*", "matchCriteriaId": "4DA0B484-221F-4E67-927F-DBCBBC1F6448", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_t20_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D1DE7CE5-6D8F-478B-AA9A-274AA74270AE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_t20:-:*:*:*:*:*:*:*", "matchCriteriaId": "48123BA8-E8D5-4AEF-A4CF-8136AFA400F4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:deebot_x2_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B39C403-6D28-41E3-A2D0-79473D6B9733", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:deebot_x2:-:*:*:*:*:*:*:*", "matchCriteriaId": "3FD5AC03-3EF9-485F-B17A-E6D9D759A844", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:goat_g1_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1AA1C6D-E86C-46B6-AA32-FB9B34D60F1D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:goat_g1:-:*:*:*:*:*:*:*", "matchCriteriaId": "75B2D398-870D-408F-817D-FDEE8C93D683", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:airbot_z1_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FE2F668D-DD5C-4E70-A677-5029C25AB65E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:airbot_z1:-:*:*:*:*:*:*:*", "matchCriteriaId": "28431C96-C4CF-4029-BBD0-1B364C406D86", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:airbot_ava_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "BA924895-0CE8-453A-98E0-0942AA33BECE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:airbot_ava:-:*:*:*:*:*:*:*", "matchCriteriaId": "C193E51C-F9DD-43FD-913D-742513E63C61", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ecovacs:airbot_andy_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1E42AEAD-D52A-45E6-97FE-A6C8FE5C59BC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ecovacs:airbot_andy:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5752722-3EC7-401D-A114-ACA4662890BA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot."}, {"lang": "es", "value": "Los robots cortac\u00e9sped y aspiradores ECOVACS utilizan una clave sim\u00e9trica determinista para descifrar las actualizaciones de firmware. Un atacante puede crear y cifrar un firmware malicioso que el robot descifrar\u00e1 e instalar\u00e1 con \u00e9xito."}], "id": "CVE-2024-52331", "lastModified": "2025-10-02T15:15:52.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}, "published": "2025-01-23T17:15:14.563", "references": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Exploit", "Third Party Advisory"], "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"}, {"source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Exploit", "Third Party Advisory"], "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html"}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-494"}, {"lang": "en", "value": "CWE-1391"}], "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_900_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5004D440-E3EE-4252-831B-7396887BA117 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_900:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0C4E3255-6E5D-46FC-8DE0-462788F1B4FD (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_n8_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ACB3D3DB-AFB6-4B36-B86D-358BE11FAE3E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_n8:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ED77EFA6-576C-411A-91D2-22C962C30C94 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_t8_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AC59B209-998B-43A6-875D-364844CA37C7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_t8:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8BA30BA8-4069-4525-A843-E88EFDC720DF (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

3 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_n9_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 43C72C62-49C3-49BE-A9F1-3572DA18647C (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_n9:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7A663879-36BF-433D-9D7A-B62D65A5C6C9 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

4 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_t9_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D16EB997-ADC3-45AA-8E92-6F1371E85A35 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_t9:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D63E5FF5-9A27-4674-B573-6929CAB3BB01 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

5 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_n10_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F7060D3C-5F7C-4324-987D-C6EB4204CC47 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_n10:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DCC67BB7-0E4A-47FA-A04D-41837A18E103 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

6 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_t10_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C7422285-BB34-4D85-A4A4-ADD006401FE7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 318C962D-54C2-456E-A045-1332A02958E9 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

7 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_x1_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A5248299-76EB-41DB-A036-5685F20D2A18 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_x1:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 4DA0B484-221F-4E67-927F-DBCBBC1F6448 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

8 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_t20_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D1DE7CE5-6D8F-478B-AA9A-274AA74270AE (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_t20:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 48123BA8-E8D5-4AEF-A4CF-8136AFA400F4 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

9 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:deebot_x2_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B39C403-6D28-41E3-A2D0-79473D6B9733 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:deebot_x2:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3FD5AC03-3EF9-485F-B17A-E6D9D759A844 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

10 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:goat_g1_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F1AA1C6D-E86C-46B6-AA32-FB9B34D60F1D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:goat_g1:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 75B2D398-870D-408F-817D-FDEE8C93D683 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

11 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:airbot_z1_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : FE2F668D-DD5C-4E70-A677-5029C25AB65E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:airbot_z1:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 28431C96-C4CF-4029-BBD0-1B364C406D86 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

12 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:airbot_ava_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BA924895-0CE8-453A-98E0-0942AA33BECE (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:airbot_ava:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C193E51C-F9DD-43FD-913D-742513E63C61 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

13 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:ecovacs:airbot_andy_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 1E42AEAD-D52A-45E6-97FE-A6C8FE5C59BC (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:ecovacs:airbot_andy:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E5752722-3EC7-401D-A114-ACA4662890BA (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. (string)

}

1 : { »

lang : es (string)

value : Los robots cortacésped y aspiradores ECOVACS utilizan una clave simétrica determinista para descifrar las actualizaciones de firmware. Un atacante puede crear y cifrar un firmware malicioso que el robot descifrará e instalará con éxito. (string)

}

]

id : CVE-2024-52331 (string)

lastModified : 2025-10-02T15:15:52.810 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 5.9 (number)

source : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

type : Secondary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

attackVector : NETWORK (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

confidentialityRequirement : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubAvailabilityImpact : NOT_DEFINED (string)

modifiedSubConfidentialityImpact : NOT_DEFINED (string)

modifiedSubIntegrityImpact : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnAvailabilityImpact : NOT_DEFINED (string)

modifiedVulnConfidentialityImpact : NOT_DEFINED (string)

modifiedVulnIntegrityImpact : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : PASSIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnAvailabilityImpact : HIGH (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

source : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

type : Secondary (string)

}

]

}

published : 2025-01-23T17:15:14.563 (string)

references : [ »

0 : { »

source : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

tags : [ »

0 : Exploit (string)

1 : Third Party Advisory (string)

]

url : https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf (string)

}

1 : { »

source : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

tags : [ »

0 : Exploit (string)

1 : Third Party Advisory (string)

]

url : https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html (string)

}

]

sourceIdentifier : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-327 (string)

}

1 : { »

lang : en (string)

value : CWE-494 (string)

}

2 : { »

lang : en (string)

value : CWE-1391 (string)

}

]

source : 9119a7d8-5eab-497f-8521-727c672e3725 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object