CVE-2024-52329

9.5 criticalEPSS 0.4%

Critical (9.5) in ecovacs home. EPSS 0.4% chance of exploitation in the next 30 days.

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

Severity

CVSS 4.0

9.5 critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

CVSS 3.1

7.4 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2025-01-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ecovacs:home

References

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
https://www.ecovacs.com/global/userhelp/dsa20241217001

Check your stack JSON