Deterministic Root Password Vulnerability in ECOVACS Robot Lawn Mowers and Vacuums

CVE-2024-11147

What is CVE-2024-11147?

ECOVACS robot lawnmowers and vacuums feature a security flaw stemming from a deterministic root password model. This vulnerability arises when the root password is generated based on the device's model and serial number, allowing attackers with shell access to easily log in as the root user. Such access can lead to unauthorized control over these devices, potentially enabling further exploits in connected systems. Affected users are urged to assess their security measures and consider recommendations to mitigate potential risks associated with this vulnerability.

References