CVE-2024-52330CWE-295

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates

Critical · published January 23, 2025

CVSS v4.0
9.5
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-01-23T16:36Z
EPSS history
Timeline
  • 23 JAN 16:36Z
    ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
    cvelistv5