CVE-2024-52325
📋 TL;DR
ECOVACS robot lawnmowers and vacuums are vulnerable to unauthenticated command injection via Bluetooth Low Energy (BLE) connections. Attackers within BLE range can execute arbitrary commands on affected devices, potentially taking full control. This affects ECOVACS robot vacuum and lawnmower models with vulnerable firmware.
💻 Affected Systems
- ECOVACS robot vacuums
- ECOVACS robot lawnmowers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing physical sabotage, theft of Wi-Fi credentials, installation of persistent malware, or use as a network pivot point.
Likely Case
Local attackers within BLE range (typically ~10 meters) could disrupt device operation, access stored data, or use the device for limited network attacks.
If Mitigated
With proper network segmentation and BLE access controls, impact is limited to device malfunction within physical proximity.
🎯 Exploit Status
Exploit demonstrated at DEFCON 32 with video proof. Attack requires BLE-capable device and proximity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released November 2024
Vendor Advisory: https://www.ecovacs.com/global/userhelp/dsa20241119
Restart Required: Yes
Instructions:
1. Open ECOVACS HOME app. 2. Check for firmware updates. 3. Apply available updates. 4. Device will restart automatically.
🔧 Temporary Workarounds
Disable BLE when not in use
allTurn off Bluetooth connectivity when device is not actively being controlled via app
Use ECOVACS HOME app settings to disable Bluetooth
Physical isolation
allKeep devices in secure areas where unauthorized BLE access is impossible
🧯 If You Can't Patch
- Physically isolate devices from untrusted areas
- Implement network segmentation to separate IoT devices from critical systems
🔍 How to Verify
Check if Vulnerable:
Check firmware version in ECOVACS HOME app. Versions before November 2024 patches are vulnerable.Check Version:
Use ECOVACS HOME app → Device Settings → Firmware VersionVerify Fix Applied:
Confirm firmware version shows post-November 2024 update in ECOVACS HOME app📡 Detection & Monitoring
Log Indicators:
- Unusual BLE connection attempts
- Unexpected device behavior logs
Network Indicators:
- Suspicious BLE traffic patterns near devices
- Unexpected network connections from device
SIEM Query:
Not applicable - primarily physical/BLE based attack