CVE-2024-52329

The ECOVACS HOME mobile application does not perform proper TLS certificate validation (CWE-295) during communication with robots. An unauthenticated attacker positioned on the network path (man-in-the-middle attack) can intercept encrypted TLS traffic or modify it. As a result, the attacker gains access to authentication tokens transmitted between the application and the device.

An attacker can read or modify TLS communication and intercept authentication tokens, which in practice means the ability to take control of the robot and access associated cloud services — potentially also within internal systems.

Apply patches available from the manufacturer according to the references: https://www.ecovacs.com/global/userhelp/dsa20241217001. Until the update is applied, it is recommended to avoid using the application on untrusted Wi-Fi networks.

ECOVACS HOME mobile application plugins supporting specific robot models — specific versions indicated in the manufacturer's references (DSA20241217001).