CVE-2024-52325
ECOVACS robot lawnmowers and vacuums command injection
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ECOVACS robot lawnmowers and vacuums command injection
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
- Record
CVE-2024-52325- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H - CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2024-46255
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
- Record
EUVD-2024-46255- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wgmc-5v7x-58m5
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an...
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
- Record
GHSA-wgmc-5v7x-58m5- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
- Record
CVE-2024-52325- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
- ecovacs deebot t30 omni
- ecovacs deebot t30s
- ecovacs deebot x2 omni
- ecovacs deebot x2 combo
- ecovacs deebot x2s
- ecovacs deebot x5 pro
- ecovacs deebot x5 pro plus
- ecovacs deebot x5 pro ultra
- ecovacs deebot t30 omni firmware
- ecovacs deebot t30s firmware
- ecovacs deebot x2 combo firmware
- ecovacs deebot x2 omni firmware
Show 12 moreShow less
- ecovacs deebot x2s firmware
- ecovacs deebot x5 pro firmware
- ecovacs deebot x5 pro plus firmware
- ecovacs deebot x5 pro ultra firmware
- ecovacs goat g1
- ecovacs goat g1-2000
- ecovacs goat g1-800
- ecovacs goat gx-600
- ecovacs goat g1-2000 firmware
- ecovacs goat g1-800 firmware
- ecovacs goat g1 firmware
- ecovacs gx-600 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52325 is a medium vulnerability (CVSS 5.8) in Ecovacs Deebot T30 Omni, published January 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 87th percentile. No source names a fixed version.