CVE-2024-52330
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
- Record
CVE-2024-52330- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2024-46259
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
- Record
EUVD-2024-46259- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m998-32q9-vxpx
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated...
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
- Record
GHSA-m998-32q9-vxpx- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
- Record
CVE-2024-52330- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
- ecovacs deebot t10
- ecovacs deebot t10 omni
- ecovacs deebot t10 plus
- ecovacs deebot t10 turbo
- ecovacs deebot x1
- ecovacs deebot x1 omni
- ecovacs deebot x1 plus
- ecovacs deebot x1 pro omni
- ecovacs deebot x1 turbo
- ecovacs deebot x1e omni
- ecovacs deebot x1s pro
- ecovacs deebot x1s pro plus
Show 28 moreShow less
- ecovacs deebot x2 omni
- ecovacs deebot x2 combo
- ecovacs deebot x2 pro
- ecovacs deebot x2s
- ecovacs deebot x5 pro
- ecovacs deebot x5 pro plus
- ecovacs deebot x5 pro ultra
- ecovacs deebot t10 firmware
- ecovacs deebot t10 omni firmware
- ecovacs deebot t10 plus firmware
- ecovacs deebot t10 turbo firmware
- ecovacs deebot x1 firmware
- ecovacs deebot x1 omni firmware
- ecovacs deebot x1 plus firmware
- ecovacs deebot x1 pro omni firmware
- ecovacs deebot x1 turbo firmware
- ecovacs deebot x1e omni firmware
- ecovacs deebot x1s pro firmware
- ecovacs deebot x1s pro plus firmware
- ecovacs deebot x2 combo firmware
- ecovacs deebot x2 omni firmware
- ecovacs deebot x2 pro firmware
- ecovacs deebot x2s firmware
- ecovacs deebot x5 pro firmware
- ecovacs deebot x5 pro plus firmware
- ecovacs deebot x5 pro ultra firmware
- ecovacs mate x
- ecovacs mate x firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52330 is a critical vulnerability (CVSS 9.5) in Ecovacs Deebot T10, published January 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.