{"answers":{"affected":"It affects 20 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52330 exists.","fix":"No fix has been published for CVE-2024-52330 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-52330 is a critical vulnerability in ECOVACS DEEBOT T10, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-52330 and fix it if it is affected.\n\nWhat it is: CVE-2024-52330 is a critical vulnerability in ECOVACS DEEBOT T10, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52330 exists.\n\nAffected product: ECOVACS DEEBOT T10. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-52330/ (Markdown: https://insights.sbomify.com/CVE-2024-52330/index.md)","id":"CVE-2024-52330","markdown":"https://insights.sbomify.com/CVE-2024-52330/index.md","name":"CVE-2024-52330","record":{"aliases":["GHSA-m998-32q9-vxpx"],"analysis":{"component_type":"iot_embedded","fix_type":"no_fix_stated","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"ECOVACS robot vacuums","requires_auth":"none","summary":"Attackers can intercept and modify TLS traffic, potentially altering firmware updates, due to improper certificate validation in ECOVACS devices.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"cisa-cg","cpe":[{"product":"deebot_t10_firmware","vendor":"ecovacs"},{"product":"deebot_t10_omni_firmware","vendor":"ecovacs"},{"product":"deebot_t10_plus_firmware","vendor":"ecovacs"},{"product":"deebot_t10_turbo_firmware","vendor":"ecovacs"},{"product":"deebot_x1_firmware","vendor":"ecovacs"},{"product":"deebot_x1_omni_firmware","vendor":"ecovacs"},{"product":"deebot_x1_plus_firmware","vendor":"ecovacs"},{"product":"deebot_x1_pro_omni_firmware","vendor":"ecovacs"},{"product":"deebot_x1_turbo_firmware","vendor":"ecovacs"},{"product":"deebot_x1e_omni_firmware","vendor":"ecovacs"},{"product":"deebot_x1s_pro_firmware","vendor":"ecovacs"},{"product":"deebot_x1s_pro_plus_firmware","vendor":"ecovacs"},{"product":"deebot_x2_combo_firmware","vendor":"ecovacs"},{"product":"deebot_x2_omni_firmware","vendor":"ecovacs"},{"product":"deebot_x2_pro_firmware","vendor":"ecovacs"},{"product":"deebot_x2s_firmware","vendor":"ecovacs"},{"product":"deebot_x5_pro_firmware","vendor":"ecovacs"},{"product":"deebot_x5_pro_plus_firmware","vendor":"ecovacs"},{"product":"deebot_x5_pro_ultra_firmware","vendor":"ecovacs"},{"product":"mate_x_firmware","vendor":"ecovacs"}],"cvss":{"score":9.5,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":null,"headline":"ECOVACS lawnmowers and vacuums do not properly validate TLS certificates","id":"CVE-2024-52330","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"weak_cryptography","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"ECOVACS lawnmowers and vacuums deterministic firmware encryption key","id":"CVE-2024-52331"},"packages":[],"prev":{"headline":"ECOVACS HOME mobile app plugins do not properly validate TLS certificates","id":"CVE-2024-52329"},"products":["DEEBOT T10","DEEBOT T10 OMNI","DEEBOT T10 PLUS","DEEBOT T10 TURBO","DEEBOT X1","DEEBOT X1 OMNI","DEEBOT X1 PLUS","DEEBOT X1 PRO OMNI","DEEBOT X1 TURBO","DEEBOT X1S PRO","DEEBOT X1S PRO PLUS","DEEBOT X1e OMNI","DEEBOT X2  OMNI","DEEBOT X2 COMBO","DEEBOT X2 PRO","DEEBOT X2S","DEEBOT X5 PRO","DEEBOT X5 PRO PLUS","DEEBOT X5 PRO ULTRA","Mate X"],"published":"2025-01-23","related":[{"cvss_score":7.5,"headline":"ECOVACS Vacuum and Base Station accept unsigned firmware","id":"CVE-2025-30199","kev_date_added":null,"published":"2025-09-05"},{"cvss_score":2.3,"headline":"ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK","id":"CVE-2025-30198","kev_date_added":null,"published":"2025-09-05"},{"cvss_score":2.3,"headline":"ECOVACS Vacuum and Base Station Hard-Coded AES Encryption","id":"CVE-2025-30200","kev_date_added":null,"published":"2025-09-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-02-12","vendors":["ECOVACS"]},"summary":"Attackers can intercept and modify TLS traffic, potentially altering firmware updates, due to improper certificate validation in ECOVACS devices.","url":"https://insights.sbomify.com/CVE-2024-52330/"}