CVE-2024-12078
Estado: AnalizadaMedia (5.3)—
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.33%
- Percentil entre todas las CVEs puntuadas: 24
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (14)
Ecovacs — Airbot Andy FirmwareEcovacs — Airbot AVA FirmwareEcovacs — Airbot Z1 FirmwareEcovacs — Deebot 900 FirmwareEcovacs — Deebot N10 FirmwareEcovacs — Deebot N8 FirmwareEcovacs — Deebot N9 FirmwareEcovacs — Deebot T10 FirmwareEcovacs — Deebot T20 FirmwareEcovacs — Deebot T8 FirmwareEcovacs — Deebot T9 FirmwareEcovacs — Deebot X1 FirmwareEcovacs — Deebot X2 FirmwareEcovacs — Goat G1 Firmware
CWE
- CWE-321
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-12078",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-12078",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-01-23T16:54:13.718772Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.3,
"Automatable": "NOT_DEFINED",
"attackVector": "ADJACENT",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"affectedData": [
{
"vendor": "ECOVACS",
"product": "Unspecified robots",
"versions": [
{
"status": "affected",
"version": "*"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-01-23T17:15:13.020",
"references": [
{
"url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
},
{
"url": "https://youtu.be/_wUsM0Mlenc?t=2041",
"tags": [
"Exploit"
],
"source": "9119a7d8-5eab-497f-8521-727c672e3725"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"description": [
{
"lang": "en",
"value": "CWE-321"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key."
},
{
"lang": "es",
"value": "Los robots cortacésped y aspiradores ECOVACS utilizan una clave secreta estática compartida para cifrar los mensajes GATT de BLE. Un atacante no autenticado dentro del alcance de BLE puede controlar cualquier robot que utilice la misma clave."
}
],
"lastModified": "2026-06-17T06:59:00.173",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_n10_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7060D3C-5F7C-4324-987D-C6EB4204CC47"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_n10:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DCC67BB7-0E4A-47FA-A04D-41837A18E103"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_t10_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7422285-BB34-4D85-A4A4-ADD006401FE7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "318C962D-54C2-456E-A045-1332A02958E9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_x1_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5248299-76EB-41DB-A036-5685F20D2A18"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_x1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4DA0B484-221F-4E67-927F-DBCBBC1F6448"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_t20_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1DE7CE5-6D8F-478B-AA9A-274AA74270AE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_t20:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "48123BA8-E8D5-4AEF-A4CF-8136AFA400F4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_x2_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B39C403-6D28-41E3-A2D0-79473D6B9733"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_x2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3FD5AC03-3EF9-485F-B17A-E6D9D759A844"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:goat_g1_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1AA1C6D-E86C-46B6-AA32-FB9B34D60F1D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:goat_g1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "75B2D398-870D-408F-817D-FDEE8C93D683"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:airbot_z1_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE2F668D-DD5C-4E70-A677-5029C25AB65E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:airbot_z1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "28431C96-C4CF-4029-BBD0-1B364C406D86"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:airbot_ava_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA924895-0CE8-453A-98E0-0942AA33BECE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:airbot_ava:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C193E51C-F9DD-43FD-913D-742513E63C61"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:airbot_andy_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E42AEAD-D52A-45E6-97FE-A6C8FE5C59BC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:airbot_andy:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E5752722-3EC7-401D-A114-ACA4662890BA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_900_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5004D440-E3EE-4252-831B-7396887BA117"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_900:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0C4E3255-6E5D-46FC-8DE0-462788F1B4FD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_n8_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACB3D3DB-AFB6-4B36-B86D-358BE11FAE3E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_n8:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "ED77EFA6-576C-411A-91D2-22C962C30C94"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_t8_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC59B209-998B-43A6-875D-364844CA37C7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_t8:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8BA30BA8-4069-4525-A843-E88EFDC720DF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_n9_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43C72C62-49C3-49BE-A9F1-3572DA18647C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_n9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7A663879-36BF-433D-9D7A-B62D65A5C6C9"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ecovacs:deebot_t9_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D16EB997-ADC3-45AA-8E92-6F1371E85A35"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ecovacs:deebot_t9:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D63E5FF5-9A27-4674-B573-6929CAB3BB01"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"
}