Описание
ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Затрагиваемое ПО
Ecovacs Deebot x2 omni firmwareEcovacs Deebot x2 omniEcovacs Deebot x2 combo firmwareEcovacs Deebot x2 comboEcovacs Deebot x2s firmwareEcovacs Deebot x2sEcovacs Deebot x5 pro firmwareEcovacs Deebot x5 proEcovacs Deebot x5 pro plus firmwareEcovacs Deebot x5 pro plusEcovacs Deebot x5 pro ultra firmwareEcovacs Deebot x5 pro ultraEcovacs Mate x firmwareEcovacs Mate xEcovacs Deebot x1 omni firmwareEcovacs Deebot x1 omniEcovacs Deebot x1 turbo firmwareEcovacs Deebot x1 turboEcovacs Deebot x1 pro omni firmwareEcovacs Deebot x1 pro omniEcovacs Deebot x1 firmwareEcovacs Deebot x1Ecovacs Deebot x1 plus firmwareEcovacs Deebot x1 plusEcovacs Deebot x1s pro firmware
CVSS
| Балл | 7.4 — высокая |
| Вектор | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Источники
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfhttps://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfhttps://www.ecovacs.com/global/userhelp/dsa20241217001