Detections
Analytics
CVE-2024-52329
critical
Description
ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
References
https://www.ecovacs.com/global/userhelp/dsa20241217001
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
Details
Published: 2025-01-23
Updated: 2025-09-23
Risk Information
CVSS v2
Base Score: 7.1
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N
Severity: High
CVSS v3
Base Score: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: High
CVSS v4
Base Score: 9.5
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Severity: Critical
EPSS
EPSS: 0.00055