CVE-2024-52331: Ecovacs Airbot Andy Firmware

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

Affected products

• Ecovacs Airbot Andy Firmware: affected versions not specified
• Ecovacs Airbot Ava Firmware: affected versions not specified
• Ecovacs Airbot z1 Firmware: affected versions not specified
• Ecovacs Deebot 900 Firmware: affected versions not specified
• Ecovacs Deebot n10 Firmware: affected versions not specified
• Ecovacs Deebot n8 Firmware: affected versions not specified
• Ecovacs Deebot n9 Firmware: affected versions not specified
• Ecovacs Deebot t10 Firmware: affected versions not specified
• Ecovacs Deebot t20 Firmware: affected versions not specified
• Ecovacs Deebot t8 Firmware: affected versions not specified
• Ecovacs Deebot t9 Firmware: affected versions not specified
• Ecovacs Deebot x1 Firmware: affected versions not specified
• Ecovacs Deebot x2 Firmware: affected versions not specified
• Ecovacs Goat g1 Firmware: affected versions not specified

Published 2025-01-23. Last modified 2026-06-17.