« Volver al listado

CVE-2024-52327

Estado: AnalizadaMedia (6)—

The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ecovacs — Home

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52327",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52327",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-23T16:53:52.437051Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "affectedData": [
        {
          "vendor": "ECOVACS",
          "product": "ECOVACS HOME",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.0.2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.0.2"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "ECOVACS",
          "product": "cloud service",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2024-12-17",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024-12-17"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-01-23T17:15:13.890",
  "references": [
    {
      "url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://www.ecovacs.com/global/userhelp/dsa20241217002",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "description": [
        {
          "lang": "en",
          "value": "CWE-603"
        },
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed."
    },
    {
      "lang": "es",
      "value": "El servicio en la nube utilizado por los robots cortacésped y aspiradores ECOVACS permite a atacantes autenticados eludir la entrada del PIN necesaria para acceder a la transmisión de vídeo en directo."
    }
  ],
  "lastModified": "2026-06-17T08:07:01.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ecovacs:home:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E821D04-DCF5-41B9-8243-81A12D3A4F81",
              "versionEndExcluding": "3.0.2"
            },
            {
              "criteria": "cpe:2.3:a:ecovacs:home:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8789EBAC-69FF-4527-87EC-DC6AF83B6E9A",
              "versionEndExcluding": "3.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"
}