Insecure Audio File Storage in ECOVACS Robot Lawn Mowers and Vacuums
CVE-2024-52328

1.8LOW

Key Information:

Vendor

Ecovacs

Status
Unspecified Robots
Vendor
CVE Published:
23 January 2025

What is CVE-2024-52328?

ECOVACS robot lawnmowers and vacuums store audio files insecurely, which can lead to a situation where attackers with access to the /data filesystem can delete or alter crucial warning files. This risk means that users may be unaware of the state of their devices' cameras, potentially exposing them to privacy violations.

Affected Version(s)

Unspecified robots *

References

https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ec...
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-...

CVSS V4

Score:
1.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.