CVE-2025-30199: Ecovacs Deebot t10 Firmware

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

Affected products

• Ecovacs Deebot t10 Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Omni Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Plus Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t10 Turbo Firmware: before 1.11.0 (fixed in 1.11.0)
• Ecovacs Deebot t20 Omni Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t20 Pro Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t20 Pro Plus Firmware: before 1.25.0 (fixed in 1.25.0)
• Ecovacs Deebot t30 Omni Firmware: before 1.100.0 (fixed in 1.100.0)
• Ecovacs Deebot t30s Firmware: before 1.100.0 (fixed in 1.100.0)
• Ecovacs Deebot x1 Omni Firmware: before 2.4.45 (fixed in 2.4.45)
• Ecovacs Deebot x1 Pro Omni Firmware: before 2.5.38 (fixed in 2.5.38)
• Ecovacs Deebot x1 Turbo Firmware: before 2.5.38 (fixed in 2.5.38)
• Ecovacs Deebot x1s Pro Firmware: before 2.5.38 (fixed in 2.5.38); before 2.4.45 (fixed in 2.4.45)

Published 2025-09-05. Last modified 2026-06-17.