CVE-2024-52330
📋 TL;DR
ECOVACS robotic lawnmowers and vacuums fail to properly validate TLS certificates, allowing unauthenticated attackers to intercept and manipulate TLS traffic. This could enable firmware update tampering, potentially leading to device compromise. All users of affected ECOVACS devices are vulnerable.
💻 Affected Systems
- ECOVACS robotic lawnmowers
- ECOVACS robotic vacuums
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could push malicious firmware updates to devices, gaining full control over robotic vacuums/lawnmowers, potentially enabling physical safety risks or using devices as network footholds.
Likely Case
Attackers intercept and modify device communications, potentially stealing sensitive data or disrupting device functionality.
If Mitigated
With proper network segmentation and monitoring, impact is limited to device functionality disruption without network compromise.
🎯 Exploit Status
Exploitation requires man-in-the-middle position on network; no authentication needed to intercept traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released December 2024
Vendor Advisory: https://www.ecovacs.com/global/userhelp/dsa20241217001
Restart Required: Yes
Instructions:
1. Open ECOVACS HOME app 2. Check for firmware updates 3. Apply available updates 4. Device will restart automatically
🔧 Temporary Workarounds
Network segmentation
allIsolate ECOVACS devices on separate VLAN without internet access
Disable automatic updates
allPrevent automatic firmware updates that could be intercepted
🧯 If You Can't Patch
- Disconnect devices from network entirely
- Monitor network traffic for TLS interception attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in ECOVACS HOME app; versions before December 2024 updates are vulnerableCheck Version:
Use ECOVACS HOME app → Device Settings → Firmware VersionVerify Fix Applied:
Confirm firmware version shows post-December 2024 update in ECOVACS HOME app📡 Detection & Monitoring
Log Indicators:
- Unusual TLS certificate validation failures
- Unexpected firmware update attempts
Network Indicators:
- Man-in-the-middle attacks on port 443 to ECOVACS servers
- Unencrypted firmware downloads
SIEM Query:
destination_port:443 AND (tls.handshake.type:1 OR tls.alert.description:42) AND destination_ip:ECOVACS_SERVERS