CVE-2024-52328
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on.
Does this matter?
Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.
Description
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
- CVSS 4.0
- 1.8 LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.21% probability · 12th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- ecovacs/deebot n8 firmware · ecovacs/deebot 900 firmware · ecovacs/deebot t8 firmware · ecovacs/deebot n9 firmware · ecovacs/deebot t9 firmware · ecovacs/deebot n10 firmware · ecovacs/deebot t10 firmware · ecovacs/deebot x1 firmware · ecovacs/deebot t20 firmware · ecovacs/deebot x2 firmware · ecovacs/goat g1 firmware · ecovacs/airbot z1 firmware · ecovacs/airbot ava firmware · ecovacs/airbot andy firmware
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
EPSS 0.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfExploit, Third Party Advisory
- https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.