CVE-2024-11147
📋 TL;DR
ECOVACS robot lawnmowers and vacuums have a predictable root password generated from model and serial number, allowing attackers with shell access to gain full system control. This affects all ECOVACS robotic devices using this authentication scheme, potentially compromising home networks and device functionality.
💻 Affected Systems
- ECOVACS robot lawnmowers
- ECOVACS robot vacuums
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network pivoting, data exfiltration, physical safety risks (lawnmowers), and persistent backdoor installation.
Likely Case
Local network compromise, device manipulation, privacy violations through camera/microphone access, and denial of service.
If Mitigated
Limited to isolated device compromise if network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit requires shell access first; password calculator available at provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available; ECOVACS has not released firmware updates addressing this vulnerability.
🔧 Temporary Workarounds
Change root password manually
allManually set a strong, unique root password via SSH if shell access is available
passwd root
Disable root SSH access
allModify SSH configuration to prevent root login
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
service ssh restart
🧯 If You Can't Patch
- Network segmentation: Isolate ECOVACS devices on separate VLAN with strict firewall rules
- Physical security: Restrict physical access to devices to prevent local exploitation
🔍 How to Verify
Check if Vulnerable:
Check if root password matches algorithm output using model/serial at ecopassword.php toolCheck Version:
cat /etc/version || uname -aVerify Fix Applied:
Attempt SSH root login with generated password; should fail after password change📡 Detection & Monitoring
Log Indicators:
- Failed SSH root login attempts
- Successful root logins from unusual sources
- /var/log/auth.log anomalies
Network Indicators:
- SSH connections to device on port 22
- Unusual outbound traffic from device
SIEM Query:
source="auth.log" AND (event="Failed password for root" OR event="Accepted password for root")