CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass
Authenticated attackers can bypass PIN requirements to access live video feeds from ECOVACS robot lawnmowers and vacuums via the cloud service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52327?
CVE-2024-52327 is a medium-severity authentication bypass vulnerability in ECOVACS HOME, published on 23 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
Which versions are affected by CVE-2024-52327?
It affects 1 product.
Products include Ecovacs Home.
How do I fix CVE-2024-52327?
No fix has been published for CVE-2024-52327 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-52327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52327 exists.
Other vulnerabilities in ECOVACS HOME
Sources
Also known as GHSA-wxx6-j873-v2qh.