CVE-2024-52330

CVE-2024-52330 is a vulnerability in ECOVACS lawnmowers and vacuums stemming from improper validation of TLS certificates, mapped to CWE-295. The affected devices fail to properly verify TLS certificates during communication, exposing encrypted traffic to interception and tampering. This issue carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with network accessibility but requiring high attack complexity.

An unauthenticated attacker positioned to intercept network traffic can exploit this vulnerability via a man-in-the-middle attack to read or modify TLS-encrypted communications. Successful exploitation could allow the attacker to alter firmware updates transmitted to the devices, potentially leading to persistent compromise or malicious modifications.

ECOVACS has issued security advisory DSA-20241217001, available at https://www.ecovacs.com/global/userhelp/dsa20241217001, which likely details mitigation steps. Further technical details on the vulnerability are provided in research presentations, including those from 37C3 2023 (https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf) and HITCON 2024 (https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf).