by Kastro
Paper/Archive/CVE-2024-52329

CVE-2024-52329

ECOVACS ECOVACS HOME — ECOVACS HOME mobile app plugins do not properly validate TLS certificates

EPSS 0.4%public exploitCVSS 9.5
critical.is priorityof 100
45
CVSS 9.5 (CNA)9.5 / 10 × 3028.5Not in CISA KEV+300.0EPSS percentile 32.5.325 × 206.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

Affected

ProductAffectedFixed inSource
ECOVACS HOME< 3.0.03.0.0CNA

Scores by source

cisa-cg (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
cisa-cg (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refdontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdfrefdontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdfrefecovacs.com/global/userhelp/dsa20241217001