CVE-2024-52331CWE-1391CWE-327CWE-494

ECOVACS lawnmowers and vacuums deterministic firmware encryption key

High · published January 23, 2025

CVSS v4.0
7.7
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00217 · 11.5th percentile
Weaknesses
CWE-1391 · Use of Weak Credentials; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm; CWE-494 · Download of Code Without Integrity Check
Published
2025-01-23T16:37Z
EPSS history
Timeline
  • 23 JAN 16:37Z
    ECOVACS lawnmowers and vacuums deterministic firmware encryption key
    cvelistv5