Security Flaw in ECOVACS Robot Lawn Mowers and Vacuums

CVE-2024-12078

What is CVE-2024-12078?

ECOVACS robot lawn mowers and vacuums utilize a static secret key to encrypt Bluetooth Low Energy (BLE) GATT messages. This design flaw permits an unauthenticated attacker within range to leverage the shared encryption key, granting unauthorized control over any affected robot. As a result, attackers can potentially manipulate the operation of ECOVACS devices without physical access, posing significant security risks to users. It's crucial for ECOVACS users to be aware of this vulnerability and implement necessary safety measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References