CVE-2024-52330: Ecovacs Deebot T10 Firmware vulnerability (CVSS 7.4)

Description

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Ecovacs Deebot T10 Firmware< 1.7.5

Ecovacs Deebot T10 Omni Firmware< 1.9.0

Ecovacs Deebot T10 Plus Firmware< 1.7.5

Ecovacs Deebot T10 Turbo Firmware< 1.10.0

Ecovacs Deebot X1e Omni Firmware< 2.4.42

Ecovacs Deebot X1 Firmware< 1.7.3

Ecovacs Deebot X1 Omni Firmware< 2.4.41

Ecovacs Deebot X1 Plus Firmware< 1.7.3

Ecovacs Deebot X1 Pro Omni Firmware< 2.4.41

Ecovacs Deebot X1s Pro Firmware< 2.5.31

Ecovacs Deebot X1s Pro Plus Firmware< 1.23.0

Ecovacs Deebot X1 Turbo Firmware< 2.4.41

Ecovacs Deebot X2 Combo Firmware< 1.81.10

Ecovacs Deebot X2 Omni Firmware< 1.76.6

Ecovacs Deebot X2 Pro Firmware< 1.76.6

Ecovacs Deebot X2s Firmware< 1.49.0

Ecovacs Deebot X5 Pro Firmware< 1.70.0

Ecovacs Deebot X5 Pro Plus Firmware< 1.38.0

Ecovacs Deebot X5 Pro Ultra Firmware< 1.17.0

Ecovacs Mate X Firmware< 1.44.18

Remediation

Fixed in

Ecovacs Deebot T10 Firmware≥ 1.7.5

Ecovacs Deebot T10 Omni Firmware≥ 1.9.0

Ecovacs Deebot T10 Plus Firmware≥ 1.7.5

Ecovacs Deebot T10 Turbo Firmware≥ 1.10.0

Ecovacs Deebot X1e Omni Firmware≥ 2.4.42

Ecovacs Deebot X1 Firmware≥ 1.7.3

Ecovacs Deebot X1 Omni Firmware≥ 2.4.41

Ecovacs Deebot X1 Plus Firmware≥ 1.7.3

Ecovacs Deebot X1 Pro Omni Firmware≥ 2.4.41

Ecovacs Deebot X1s Pro Firmware≥ 2.5.31

Patch & vendor advisories

https://www.ecovacs.com/global/userhelp/dsa20241217001

References

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfExploitThird Party Advisory
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfExploitThird Party Advisory
https://www.ecovacs.com/global/userhelp/dsa20241217001Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-52330 being actively exploited?

CVE-2024-52330 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.35%.

How severe is CVE-2024-52330?

CVE-2024-52330 has a CVSS 3.1 base score of 7.4, rated high. EPSS estimates a 0.35% probability of exploitation.

Which products are affected by CVE-2024-52330?

Affected products include Ecovacs Deebot T10 Firmware, Ecovacs Deebot T10 Omni Firmware, Ecovacs Deebot T10 Plus Firmware, Ecovacs Deebot T10 Turbo Firmware, Ecovacs Deebot X1e Omni Firmware, and 15 more.

How do I fix CVE-2024-52330?

Upgrade affected software to a fixed version, for example Ecovacs Deebot T10 Firmware 1.7.5, Ecovacs Deebot T10 Omni Firmware 1.9.0, Ecovacs Deebot T10 Plus Firmware 1.7.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-52330 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo