Security Flaw in ECOVACS Robot Lawn Mowers and Vacuums

CVE-2024-12078

What is CVE-2024-12078?

ECOVACS robot lawn mowers and vacuums utilize a static secret key to encrypt Bluetooth Low Energy (BLE) GATT messages. This design flaw permits an unauthenticated attacker within range to leverage the shared encryption key, granting unauthorized control over any affected robot. As a result, attackers can potentially manipulate the operation of ECOVACS devices without physical access, posing significant security risks to users. It's crucial for ECOVACS users to be aware of this vulnerability and implement necessary safety measures.

References