CVE-2024-52325 MEDIUM

CVE-2024-52325: ECOVACS robot lawnmowers and vacuums command injection

Vendor Ecovacs
Product GOAT G1
Weakness CWE-77
Published January 23, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.

Key dates

02Disclosure timeline

January 23, 2025 CVE published
February 12, 2025 Record updated