Deterministic Key Vulnerability in ECOVACS Robot Lawn Mowers and Vacuums

CVE-2024-52331

What is CVE-2024-52331?

ECOVACS robot lawnmowers and vacuums have a vulnerability that arises from the use of a deterministic symmetric key for decrypting firmware updates. This flaw allows an attacker to create malicious firmware that, once encrypted, can be installed on the device without detection. The implications of this vulnerability include unauthorized control over the device and the potential for exploitation of personal data collected by the robot, posing significant risks to user privacy and security.

References