CVE-2024-42911

CVE-2024-42911 is a WiFi Remote Code Execution vulnerability (CWE-94) in ECOVACS Robotics Deebot T20 OMNI and T20e OMNI devices running versions prior to 1.24.0. The issue allows attackers to execute arbitrary code over WiFi connections and carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network accessibility, high attack complexity, no privileges or user interaction required, and high impacts to confidentiality and integrity but none to availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network by leveraging WiFi access to the affected devices. Successful exploitation enables full remote code execution, potentially allowing control over the robot vacuum's functions, data access, or further network pivoting depending on the executed code.

ECOVACS has published security advisory DSA20250113001 at https://www.ecovacs.com/global/userhelp/dsa20250113001 detailing the issue, with mitigation available by updating affected Deebot T20 OMNI and T20e OMNI devices to version 1.24.0 or later. Additional information is available at http://ecovacs.com.