CVE-2024-11147: Ecovacs Airbot Andy Firmware

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

Affected products

• Ecovacs Airbot Andy Firmware: affected versions not specified
• Ecovacs Airbot Ava Firmware: affected versions not specified
• Ecovacs Airbot z1 Firmware: affected versions not specified
• Ecovacs Deebot 900 Firmware: affected versions not specified
• Ecovacs Deebot n10 Firmware: affected versions not specified
• Ecovacs Deebot n8 Firmware: affected versions not specified
• Ecovacs Deebot n9 Firmware: affected versions not specified
• Ecovacs Deebot t10 Firmware: affected versions not specified
• Ecovacs Deebot t20 Firmware: affected versions not specified
• Ecovacs Deebot t8 Firmware: affected versions not specified
• Ecovacs Deebot t9 Firmware: affected versions not specified
• Ecovacs Deebot x1 Firmware: affected versions not specified
• Ecovacs Deebot x2 Firmware: affected versions not specified
• Ecovacs Goat g1 Firmware: affected versions not specified

Published 2025-01-23. Last modified 2026-06-17.