GCVE - cpe:2.3:h:ecovacs:deebot_t30s:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:ecovacs:deebot_t30s:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Ecovacs (`970385e2-1d45-53ea-a811-676ddc52336f`)
Product	Deebot T30S (`e20b54e0-9210-5300-9e14-ab4c50f032b3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-30200`	not_vulnerable	2026-06-08 07:16:59.266846	ECOVACS Vacuum and Base Station Hard-Coded AES Encryption MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. Published: 2025-09-05T17:43:20.802Z Updated: 2025-09-08T18:22:21.457Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30200	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30199`	not_vulnerable	2026-06-08 07:16:59.263837	ECOVACS Vacuum and Base Station accept unsigned firmware HIGH (7.2) ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station. Published: 2025-09-05T17:45:07.227Z Updated: 2025-09-08T18:21:06.626Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30199	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30198`	not_vulnerable	2026-06-08 07:16:59.261200	ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. Published: 2025-09-05T17:45:36.945Z Updated: 2025-09-08T18:20:26.088Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30198	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52325`	not_vulnerable	2026-06-08 06:52:14.842796	ECOVACS robot lawnmowers and vacuums command injection CRITICAL (9.6) ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. Published: 2025-01-23T15:56:30.185Z Updated: 2025-02-12T20:41:26.651Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf https://youtu.be/_wUsM0Mlenc?t=2041 https://www.ecovacs.com/global/userhelp/dsa20241130001 https://www.ecovacs.com/global/userhelp/dsa20241119	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.