CVE-2024-52331

Katalog CVE

CVSS 7.5 · High EPSS 0,22%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada ecovacs deebot 900 firmware, ecovacs deebot n8 firmware +12 lainnya. Skor CVSS 3.1 7.5 (High) menurut CNA.

Deskripsi (NVD)

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

Rincian

Terbit di NVD

23 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-494: Download of Code Without Integrity Check
CWE-1391: Use of Weak Credentials

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf exploit · advisory pihak ketiga
• https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html exploit · advisory pihak ketiga