CVE-2024-12079: Ecovacs Airbot Andy Firmware

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.

Affected products

• Ecovacs Airbot Andy Firmware: affected versions not specified
• Ecovacs Airbot Ava Firmware: affected versions not specified
• Ecovacs Airbot z1 Firmware: affected versions not specified
• Ecovacs Deebot 900 Firmware: affected versions not specified
• Ecovacs Deebot n10 Firmware: affected versions not specified
• Ecovacs Deebot n8 Firmware: affected versions not specified
• Ecovacs Deebot n9 Firmware: affected versions not specified
• Ecovacs Deebot t10 Firmware: affected versions not specified
• Ecovacs Deebot t20 Firmware: affected versions not specified
• Ecovacs Deebot t8 Firmware: affected versions not specified
• Ecovacs Deebot t9 Firmware: affected versions not specified
• Ecovacs Deebot x1 Firmware: affected versions not specified
• Ecovacs Deebot x2 Firmware: affected versions not specified
• Ecovacs Goat g1 Firmware: affected versions not specified

Published 2025-01-23. Last modified 2026-06-17.