GCVE - cpe:2.3:o:ecovacs:deebot_x1s_pro_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:ecovacs:deebot_x1s_pro_firmware:*:*:*:*:*:*:*:*

part: o version: * update: *

Vendor	Ecovacs (`970385e2-1d45-53ea-a811-676ddc52336f`)
Product	Deebot X1S Pro Firmware (`02965ba3-36c2-59ec-932b-3ad657159839`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-30200`	vulnerable	2026-06-08 07:16:59.264859	ECOVACS Vacuum and Base Station Hard-Coded AES Encryption MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. Published: 2025-09-05T17:43:20.802Z Updated: 2025-09-08T18:22:21.457Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30200	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30199`	vulnerable	2026-06-08 07:16:59.262021	ECOVACS Vacuum and Base Station accept unsigned firmware HIGH (7.2) ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station. Published: 2025-09-05T17:45:07.227Z Updated: 2025-09-08T18:21:06.626Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30199	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30198`	vulnerable	2026-06-08 07:16:59.241047	ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK MEDIUM (6.3) ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. Published: 2025-09-05T17:45:36.945Z Updated: 2025-09-08T18:20:26.088Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json https://www.cve.org/CVERecord?id=CVE-2025-30198	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52330`	vulnerable	2026-06-08 06:52:14.889856	ECOVACS lawnmowers and vacuums do not properly validate TLS certificates HIGH (7.4) ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates. Published: 2025-01-23T16:36:50.128Z Updated: 2025-02-12T20:41:28.969Z Open on db.gcve.eu Reference links https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://www.ecovacs.com/global/userhelp/dsa20241217001	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.