Ecovacs vulnerabilities
Published CVEs affecting Ecovacs products: 3 record(s), with severity, exploitation and fixes.
Deebot X1s Pro Firmware 3Deebot X1 Pro Omni Firmware 3Deebot X1 Omni Firmware 3Deebot X1 Turbo Firmware 3Deebot T10 Firmware 3Deebot T10 Omni Firmware 3Deebot T10 Plus Firmware 3Deebot T10 Turbo Firmware 3Deebot T20 Omni Firmware 3Deebot T20 Pro Plus Firmware 3Deebot T20 Pro Firmware 3Deebot T30 Omni Firmware 3Deebot T30s Firmware 3
CVE-2025-30200
Medium · 6.3
CWE-321 Sep 5, 2025
ECOVACS Vacuum and Base Station Hard-Coded AES Encryption
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
CVE-2025-30199
High · 7.2
CWE-494 Sep 5, 2025
ECOVACS Vacuum and Base Station accept unsigned firmware
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
CVE-2025-30198
Medium · 6.3
CWE-798 Sep 5, 2025
ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.