Details of VAR-202501-2794

ID

VAR-202501-2794

CVE

CVE-2024-52331

TITLE

plural ECOVACS Vulnerability related to insufficient integrity verification of downloaded code in products

Trust: 0.8

sources: JVNDB: JVNDB-2024-028231

DESCRIPTION

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. DEEBOT 900 firmware, DEEBOT N8 firmware, DEEBOT T8 firmware etc. ECOVACS The product contains vulnerabilities related to the insufficient integrity verification of downloaded code and the use of weak authentication credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-52331 // JVNDB: JVNDB-2024-028231

AFFECTED PRODUCTS

vendor:	ecovacs	model:	deebot t10	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot n10	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot x1	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot x2	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot n8	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot t20	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	goat g1	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	airbot ava	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	airbot z1	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot n9	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	airbot andy	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot t8	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot t9	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	deebot 900	scope:	eq	version:	-	Trust: 1.0
vendor:	ecovacs	model:	airbot ava	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot t10	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot t9	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	goat g1	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot x1	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	airbot andy	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot t8	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot t20	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot n9	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot 900	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot n8	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot x2	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	airbot z1	scope:	-	version:	-	Trust: 0.8
vendor:	ecovacs	model:	deebot n10	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-028231 // NVD: CVE-2024-52331

CVSS

SEVERITY

CVSSV2

CVSSV3

9119a7d8-5eab-497f-8521-727c672e3725:	CVE-2024-52331
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2024-028231
value:	HIGH
Trust: 0.8

9119a7d8-5eab-497f-8521-727c672e3725:	CVE-2024-52331
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-028231
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-028231 // NVD: CVE-2024-52331

PROBLEMTYPE DATA

problemtype:	CWE-1391	Trust: 1.0
problemtype:	CWE-494	Trust: 1.0
problemtype:	CWE-327	Trust: 1.0
problemtype:	Using weak credentials (CWE-1391) [ others ]	Trust: 0.8
problemtype:	Incomplete integrity verification of downloaded code (CWE-494) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-028231 // NVD: CVE-2024-52331

EXTERNAL IDS

db:	NVD	id:	CVE-2024-52331	Trust: 2.6
db:	JVNDB	id:	JVNDB-2024-028231	Trust: 0.8

sources: JVNDB: JVNDB-2024-028231 // NVD: CVE-2024-52331

REFERENCES

url:	https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf	Trust: 1.8
url:	https://dontvacuum.me/talks/hitcon2024/hitcon-cmt-2024_ecovacs.html	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-52331	Trust: 0.8

sources: JVNDB: JVNDB-2024-028231 // NVD: CVE-2024-52331

SOURCES

db:	JVNDB	id:	JVNDB-2024-028231
db:	NVD	id:	CVE-2024-52331

LAST UPDATE DATE

2025-10-03T23:34:16.906000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-028231	date:	2025-09-30T07:49:00
db:	NVD	id:	CVE-2024-52331	date:	2025-10-02T15:15:52.810

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-028231	date:	2025-09-30T00:00:00
db:	NVD	id:	CVE-2024-52331	date:	2025-01-23T17:15:14.563