TLS Certificate Validation Flaw in ECOVACS HOME Mobile App for Smart Robots

CVE-2024-52329

What is CVE-2024-52329?

The ECOVACS HOME mobile app for specific robot models contains a vulnerability that allows an unauthenticated attacker to bypass proper validation of TLS certificates. This security flaw enables the attacker to intercept and manipulate TLS traffic, potentially leading to the unauthorized retrieval of authentication tokens. The lack of verification mechanisms poses a significant risk, especially in environments where sensitive information is transmitted.

References