CVE-2024-12078
PoC ×2—CVSS 4.0
5.3 medium
EPSS
<1%p26
Published
()
Modified
Description
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
- Vendors
- ecovacs
- Products
- deebot n10 firmware, deebot t10 firmware, deebot x1 firmware, deebot t20 firmware, deebot x2 firmware, goat g1 firmware, airbot z1 firmware, airbot ava firmware, airbot andy firmware, deebot 900 firmware, deebot n8 firmware, deebot t8 firmware
- Weakness
- CWE-321
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news0 stories
No ingested article mentions this CVE yet.