CVE-2024-52329CWE-295

ECOVACS HOME mobile app plugins do not properly validate TLS certificates

Critical · published January 23, 2025

CVSS v4.0
9.5
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-01-23T16:36Z
EPSS history
Timeline
  • 23 JAN 16:36Z
    ECOVACS HOME mobile app plugins do not properly validate TLS certificates
    cvelistv5