CVE-2024-52325
Published: 23 January 2025
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2024-52325 is a command injection vulnerability (CWE-77) affecting ECOVACS robot lawnmowers and vacuums. The issue resides in the SetNetPin() function, which is exposed over an unauthenticated Bluetooth Low Energy (BLE) connection. It carries a CVSS v3.1 base score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
An attacker in adjacent physical proximity, within BLE range, can exploit the vulnerability with low attack complexity, no required privileges, and no user interaction. Exploitation enables command injection, achieving high impacts on confidentiality, integrity, and availability across a changed scope, potentially allowing full device compromise.
ECOVACS has issued security advisories DSA-2024-11-19 and DSA-2024-11-30-001 detailing mitigations, available at their user help portal. Further technical analysis appears in a DEFCON 32 presentation on reverse engineering and hacking ECOVACS robots, including a related YouTube recording.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Unauthenticated command injection via SetNetPin() over BLE enables arbitrary remote command execution (T1059) through exploitation of the vulnerable remote BLE service (T1210).