CVE-2024-52325
Critical
Description
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
SeverityCritical
CVSS9.6
Exploit probability—
ProductEcovacs Goat G1-2000 Firmware
PublishedJan 23, 2025
First seenJan 23, 2025
Weakness typeCWE-77Command injection
How to fix
Update
- ecovacs goat_g1-2000_firmware1.36.187 or later
- ecovacs goat_g1_firmware1.36.187 or later
- ecovacs goat_g1-800_firmware1.36.187 or later
- ecovacs gx-600_firmware1.2.120 or later
- ecovacs deebot_x2_omni_firmware1.76.6 or later
- ecovacs deebot_x2_combo_firmware1.81.10 or later
- ecovacs deebot_x2s_firmware1.49.0 or later
- ecovacs deebot_x5_pro_firmware1.70.0 or later
- ecovacs deebot_x5_pro_plus_firmware1.38.0 or later
- ecovacs deebot_x5_pro_ultra_firmware1.17.0 or later
- ecovacs deebot_t30_omni_firmware1.93.0 or later
- ecovacs deebot_t30s_firmware1.95.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ecovacs goat_g1-2000_firmware | v < 1.36.187 | 1.36.187 |
| ecovacs goat_g1_firmware | v < 1.36.187 | 1.36.187 |
| ecovacs goat_g1-800_firmware | v < 1.36.187 | 1.36.187 |
| ecovacs gx-600_firmware | v < 1.2.120 | 1.2.120 |
| ecovacs deebot_x2_omni_firmware | v < 1.76.6 | 1.76.6 |
| ecovacs deebot_x2_combo_firmware | v < 1.81.10 | 1.81.10 |
| ecovacs deebot_x2s_firmware | v < 1.49.0 | 1.49.0 |
| ecovacs deebot_x5_pro_firmware | v < 1.70.0 | 1.70.0 |
| ecovacs deebot_x5_pro_plus_firmware | v < 1.38.0 | 1.38.0 |
| ecovacs deebot_x5_pro_ultra_firmware | v < 1.17.0 | 1.17.0 |
| ecovacs deebot_t30_omni_firmware | v < 1.93.0 | 1.93.0 |
| ecovacs deebot_t30s_firmware | v < 1.95.0 | 1.95.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.