GCVE - cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Ecovacs (`970385e2-1d45-53ea-a811-676ddc52336f`)
Product	Deebot T10 (`44ff35f2-b793-59a5-9874-2d1717b7c8cf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-30200`	not_vulnerable	2026-06-03 15:00:27.533226	ECOVACS Vacuum and Base Station Hard-Coded AES Encryption MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. Published: 2025-09-05T17:43:20.802Z Updated: 2025-09-08T18:22:21.457Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30200	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30199`	not_vulnerable	2026-06-03 15:00:27.531190	ECOVACS Vacuum and Base Station accept unsigned firmware HIGH (7.2) ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station. Published: 2025-09-05T17:45:07.227Z Updated: 2025-09-08T18:21:06.626Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30199	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30198`	not_vulnerable	2026-06-03 15:00:27.517588	ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. Published: 2025-09-05T17:45:36.945Z Updated: 2025-09-08T18:20:26.088Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30198	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52331`	not_vulnerable	2026-06-03 14:57:29.164310	ECOVACS lawnmowers and vacuums deterministic firmware encryption key HIGH (7.5) ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. Published: 2025-01-23T16:37:31.290Z Updated: 2025-10-02T14:10:10.821Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52330`	not_vulnerable	2026-06-03 14:57:29.159096	ECOVACS lawnmowers and vacuums do not properly validate TLS certificates HIGH (7.4) ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates. Published: 2025-01-23T16:36:50.128Z Updated: 2025-02-12T20:41:28.969Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://www.ecovacs.com/global/userhelp/dsa20241217001	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52328`	not_vulnerable	2026-06-03 14:57:29.110687	ECOVACS lawnmowers and vacuums insecurely store audio warning files LOW (2.3) ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on. Published: 2025-01-23T16:35:23.197Z Updated: 2025-02-12T20:41:29.266Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-12079`	not_vulnerable	2026-06-03 14:54:15.537889	ECOVACS lawnmowers cleartext storage of anti-theft PIN LOW (3.3) ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism. Published: 2025-01-23T16:39:06.903Z Updated: 2025-02-12T17:12:21.831Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-12078`	not_vulnerable	2026-06-03 14:54:15.536473	ECOVACS lawnmowers and vacuums static BLE GATT encryption key MEDIUM (6.3) ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key. Published: 2025-01-23T16:38:48.017Z Updated: 2025-02-12T17:11:14.933Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://youtu.be/_wUsM0Mlenc?t=2041	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-11147`	not_vulnerable	2026-06-03 14:54:13.541316	ECOVACS lawnmowers and vacuums deterministic root password HIGH (7.6) ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root. Published: 2025-01-23T16:37:54.479Z Updated: 2025-02-12T17:07:28.749Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://builder.dontvacuum.me/ecopassword.php	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.