CVE-2025-30198: Ecovacs Deebot t10 Firmware

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

Affected products

• Ecovacs Deebot t10 Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Omni Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Plus Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Turbo Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t20 Omni Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t20 Pro Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t20 Pro Plus Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t30 Omni Firmware: before 1.100.0 (fixed in 1.100.0)
• Ecovacs Deebot t30s Firmware: before 1.100.0 (fixed in 1.100.0)
• Ecovacs Deebot x1 Omni Firmware: before 2.4.45 (fixed in 2.4.45)
• Ecovacs Deebot x1 Pro Omni Firmware: before 2.5.38 (fixed in 2.5.38)
• Ecovacs Deebot x1 Turbo Firmware: before 2.5.38 (fixed in 2.5.38)
• Ecovacs Deebot x1s Pro Firmware: before 2.5.38 (fixed in 2.5.38); before 2.4.45 (fixed in 2.4.45)

Published 2025-09-05. Last modified 2026-06-17.