Command Injection Vulnerability in ECOVACS Robot Lawn Mowers and Vacuums

CVE-2024-52325

What is CVE-2024-52325?

ECOVACS robot lawnmowers and vacuums are exposed to a command injection vulnerability that allows attackers to exploit the SetNetPin() function over an unauthenticated BLE connection. This could enable unauthorized commands to be executed, compromising the security and operational integrity of the devices. Users of these products should be aware of the risks associated with this vulnerability and take appropriate measures to secure their devices.

References