CVE-2024-52328: Ecovacs Airbot Andy Firmware

Low severity, CVSS 2.3. EPSS: 0.2% chance of exploitation in the next 30 days.

ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.

Affected products

• Ecovacs Airbot Andy Firmware: affected versions not specified
• Ecovacs Airbot Ava Firmware: affected versions not specified
• Ecovacs Airbot z1 Firmware: affected versions not specified
• Ecovacs Deebot 900 Firmware: affected versions not specified
• Ecovacs Deebot n10 Firmware: affected versions not specified
• Ecovacs Deebot n8 Firmware: affected versions not specified
• Ecovacs Deebot n9 Firmware: affected versions not specified
• Ecovacs Deebot t10 Firmware: affected versions not specified
• Ecovacs Deebot t20 Firmware: affected versions not specified
• Ecovacs Deebot t8 Firmware: affected versions not specified
• Ecovacs Deebot t9 Firmware: affected versions not specified
• Ecovacs Deebot x1 Firmware: affected versions not specified
• Ecovacs Deebot x2 Firmware: affected versions not specified
• Ecovacs Goat g1 Firmware: affected versions not specified

Published 2025-01-23. Last modified 2026-06-17.