CVE-2024-12078: Ecovacs Airbot Andy Firmware

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.

Affected products

• Ecovacs Airbot Andy Firmware: affected versions not specified
• Ecovacs Airbot Ava Firmware: affected versions not specified
• Ecovacs Airbot z1 Firmware: affected versions not specified
• Ecovacs Deebot 900 Firmware: affected versions not specified
• Ecovacs Deebot n10 Firmware: affected versions not specified
• Ecovacs Deebot n8 Firmware: affected versions not specified
• Ecovacs Deebot n9 Firmware: affected versions not specified
• Ecovacs Deebot t10 Firmware: affected versions not specified
• Ecovacs Deebot t20 Firmware: affected versions not specified
• Ecovacs Deebot t8 Firmware: affected versions not specified
• Ecovacs Deebot t9 Firmware: affected versions not specified
• Ecovacs Deebot x1 Firmware: affected versions not specified
• Ecovacs Deebot x2 Firmware: affected versions not specified
• Ecovacs Goat g1 Firmware: affected versions not specified

Published 2025-01-23. Last modified 2026-06-17.