CVSS 4.0
9.5 criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:HCVE-2024-52330
Critical (9.5) in ecovacs. EPSS 0.4% chance of exploitation in the next 30 days.
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Severity
CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ecovacs:deebot_t10_firmware
- ecovacs:deebot_t10_omni_firmware
- ecovacs:deebot_t10_plus_firmware
- ecovacs:deebot_t10_turbo_firmware
- ecovacs:deebot_x1_firmware
- ecovacs:deebot_x1_omni_firmware
- ecovacs:deebot_x1_plus_firmware
- ecovacs:deebot_x1_pro_omni_firmware
- ecovacs:deebot_x1_turbo_firmware
- ecovacs:deebot_x1e_omni_firmware
- ecovacs:deebot_x1s_pro_firmware
- ecovacs:deebot_x1s_pro_plus_firmware
- ecovacs:deebot_x2_combo_firmware
- ecovacs:deebot_x2_omni_firmware
- ecovacs:deebot_x2_pro_firmware
- ecovacs:deebot_x2s_firmware
- ecovacs:deebot_x5_pro_firmware
- ecovacs:deebot_x5_pro_plus_firmware
- ecovacs:deebot_x5_pro_ultra_firmware
- ecovacs:mate_x_firmware