CVE-2025-44251
📋 TL;DR
Ecovacs Deebot T10 robot vacuum transmits Wi-Fi credentials in unencrypted plaintext during device pairing, allowing attackers on the same network to intercept sensitive authentication data. This affects all users of the vulnerable firmware version during initial setup or re-pairing.
💻 Affected Systems
- Ecovacs Deebot T10 robot vacuum
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers capture Wi-Fi credentials, gain full network access, pivot to other devices, and potentially compromise the entire home/office network.
Likely Case
Local network attackers intercept Wi-Fi passwords, enabling unauthorized network access and potential surveillance of network traffic.
If Mitigated
With network segmentation and strong perimeter controls, impact limited to isolated IoT network segment.
🎯 Exploit Status
Attack requires network sniffing tools like Wireshark on same network during pairing
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://ecovacs.com
Restart Required: No
Instructions:
1. Check Ecovacs app for firmware updates
2. If update available, install via app
3. Re-pair device after update
4. Change Wi-Fi password as precaution
🔧 Temporary Workarounds
Use Dedicated IoT Network
allPlace Deebot on isolated VLAN/network segment separate from main devices
Monitor Network Traffic
linuxUse network monitoring to detect credential transmission
sudo tcpdump -i eth0 -w deebot_capture.pcap
🧯 If You Can't Patch
- Avoid re-pairing device unless absolutely necessary
- Change Wi-Fi password after any pairing activity
🔍 How to Verify
Check if Vulnerable:
Monitor network traffic during pairing process for plaintext Wi-Fi credentialsCheck Version:
Check in Ecovacs mobile app under Device Settings > Firmware VersionVerify Fix Applied:
Check firmware version in Ecovacs app and verify >1.7.2📡 Detection & Monitoring
Log Indicators:
- Unusual network pairing attempts
- Multiple failed pairing events
Network Indicators:
- Plaintext credential transmission on port 8888
- Unencrypted Deebot protocol traffic
SIEM Query:
source="network_traffic" dest_port=8888 AND protocol="TCP" AND payload_contains="password"