CVE-2024-52328CWE-732

ECOVACS lawnmowers and vacuums insecurely store audio warning files

Low · published January 23, 2025

CVSS v4.0
1.8
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.

The record
Technical detail
CVSS v4.0
1.8 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
EPSS
0.00213 · 11.1th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-01-23T16:35Z
EPSS history
Timeline
  • 23 JAN 16:35Z
    ECOVACS lawnmowers and vacuums insecurely store audio warning files
    cvelistv5