CVE-2024-52328

Katalog CVE

CVSS 2.3 · Low EPSS 0,21%

Kerentanan Incorrect Permission Assignment for Critical Resource pada ecovacs deebot n8 firmware, ecovacs deebot 900 firmware +12 lainnya. Skor CVSS 3.1 2.3 (Low) menurut CNA.

Deskripsi (NVD)

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.

Rincian

Terbit di NVD

23 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.3 (Low), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf exploit · advisory pihak ketiga
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf exploit · advisory pihak ketiga