Описание
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
Затрагиваемое ПО
Ecovacs Deebot 900 firmwareEcovacs Deebot 900Ecovacs Deebot n8 firmwareEcovacs Deebot n8Ecovacs Deebot t8 firmwareEcovacs Deebot t8Ecovacs Deebot n9 firmwareEcovacs Deebot n9Ecovacs Deebot t9 firmwareEcovacs Deebot t9Ecovacs Deebot n10 firmwareEcovacs Deebot n10Ecovacs Deebot t10 firmwareEcovacs Deebot t10Ecovacs Deebot x1 firmwareEcovacs Deebot x1Ecovacs Deebot t20 firmwareEcovacs Deebot t20Ecovacs Deebot x2 firmwareEcovacs Deebot x2Ecovacs Goat g1 firmwareEcovacs Goat g1Ecovacs Airbot z1 firmwareEcovacs Airbot z1Ecovacs Airbot ava firmware
CVSS
| Балл | 7.5 — высокая |
| Вектор | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Источники
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfhttps://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html