CVE-2024-52330: Ecovacs Deebot t10 Firmware

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.

Affected products

• Ecovacs Deebot t10 Firmware: before 1.7.5 (fixed in 1.7.5)
• Ecovacs Deebot t10 Omni Firmware: before 1.9.0 (fixed in 1.9.0)
• Ecovacs Deebot t10 Plus Firmware: before 1.7.5 (fixed in 1.7.5)
• Ecovacs Deebot t10 Turbo Firmware: before 1.10.0 (fixed in 1.10.0)
• Ecovacs Deebot x1 Firmware: before 1.7.3 (fixed in 1.7.3)
• Ecovacs Deebot x1 Omni Firmware: before 2.4.41 (fixed in 2.4.41)
• Ecovacs Deebot x1 Plus Firmware: before 1.7.3 (fixed in 1.7.3)
• Ecovacs Deebot x1 Pro Omni Firmware: before 2.4.41 (fixed in 2.4.41)
• Ecovacs Deebot x1 Turbo Firmware: before 2.4.41 (fixed in 2.4.41)
• Ecovacs Deebot x1e Omni Firmware: before 2.4.42 (fixed in 2.4.42)
• Ecovacs Deebot x1s Pro Firmware: before 2.5.31 (fixed in 2.5.31)
• Ecovacs Deebot x1s Pro Plus Firmware: before 1.23.0 (fixed in 1.23.0)
• Ecovacs Deebot x2 Combo Firmware: before 1.81.10 (fixed in 1.81.10)
• Ecovacs Deebot x2 Omni Firmware: before 1.76.6 (fixed in 1.76.6)
• Ecovacs Deebot x2 Pro Firmware: before 1.76.6 (fixed in 1.76.6)
• Ecovacs Deebot x2s Firmware: before 1.49.0 (fixed in 1.49.0)
• Ecovacs Deebot x5 Pro Firmware: before 1.70.0 (fixed in 1.70.0)
• Ecovacs Deebot x5 Pro Plus Firmware: before 1.38.0 (fixed in 1.38.0)
• Ecovacs Deebot x5 Pro Ultra Firmware: before 1.17.0 (fixed in 1.17.0)
• Ecovacs Mate X Firmware: before 1.44.18 (fixed in 1.44.18)

Published 2025-01-23. Last modified 2026-06-17.