CVE-2024-52330
critical · 9.5ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
9.5
CVSS
0.3%
EPSS (exploit prob.)
28th
EPSS percentile
2025-01-23
Published
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-295
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| ecovacs | deebot_x2_omni_firmware | < 1.76.6 |
| ecovacs | deebot_x2_omni | all versions |
| ecovacs | deebot_x2_combo_firmware | < 1.81.10 |
| ecovacs | deebot_x2_combo | all versions |
| ecovacs | deebot_x2s_firmware | < 1.49.0 |
| ecovacs | deebot_x2s | all versions |
| ecovacs | deebot_x5_pro_firmware | < 1.70.0 |
| ecovacs | deebot_x5_pro | all versions |
| ecovacs | deebot_x5_pro_plus_firmware | < 1.38.0 |
| ecovacs | deebot_x5_pro_plus | all versions |
| ecovacs | deebot_x5_pro_ultra_firmware | < 1.17.0 |
| ecovacs | deebot_x5_pro_ultra | all versions |
| ecovacs | mate_x_firmware | < 1.44.18 |
| ecovacs | mate_x | all versions |
| ecovacs | deebot_x1_omni_firmware | < 2.4.41 |
| ecovacs | deebot_x1_omni | all versions |
| ecovacs | deebot_x1_turbo_firmware | < 2.4.41 |
| ecovacs | deebot_x1_turbo | all versions |
| ecovacs | deebot_x1_pro_omni_firmware | < 2.4.41 |
| ecovacs | deebot_x1_pro_omni | all versions |
| ecovacs | deebot_x1_firmware | < 1.7.3 |
| ecovacs | deebot_x1 | all versions |
| ecovacs | deebot_x1_plus_firmware | < 1.7.3 |
| ecovacs | deebot_x1_plus | all versions |
| ecovacs | deebot_x1s_pro_firmware | < 2.5.31 |
| ecovacs | deebot_x1s_pro | all versions |
| ecovacs | deebot_x1s_pro_plus_firmware | < 1.23.0 |
| ecovacs | deebot_x1s_pro_plus | all versions |
| ecovacs | deebot_x1e_omni_firmware | < 2.4.42 |
| ecovacs | deebot_x1e_omni | all versions |
| ecovacs | deebot_t10_turbo_firmware | < 1.10.0 |
| ecovacs | deebot_t10_turbo | all versions |
| ecovacs | deebot_t10_plus_firmware | < 1.7.5 |
| ecovacs | deebot_t10_plus | all versions |
| ecovacs | deebot_t10_firmware | < 1.7.5 |
| ecovacs | deebot_t10 | all versions |
| ecovacs | deebot_t10_omni_firmware | < 1.9.0 |
| ecovacs | deebot_t10_omni | all versions |
| ecovacs | deebot_x2_pro_firmware | < 1.76.6 |
| ecovacs | deebot_x2_pro | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-52330