Ecovacs Deebot x1 Turbo Firmware vulnerabilities

4 CVEs affecting Ecovacs Deebot x1 Turbo Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30200, published 2025-09-05.

More from Ecovacs.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-52330, published 2025-01-23. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
• CVE-2025-30199, published 2025-09-05. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
• CVE-2025-30198, published 2025-09-05. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
• CVE-2025-30200, published 2025-09-05. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.