CVE-2025-30198 ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK
Attackers can derive the deterministic WPA2-PSK to access the insecure Wi-Fi network of ECOVACS robot vacuums and base stations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30198?
CVE-2025-30198 is a low-severity vulnerability in ECOVACS DEEBOT T10 Series, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
Which versions are affected by CVE-2025-30198?
It affects 13 products.
Products include Ecovacs Deebot T10 Firmware, Ecovacs Deebot T10 Omni Firmware, Ecovacs Deebot T10 Plus Firmware, Ecovacs Deebot T10 Turbo Firmware, Ecovacs Deebot T20 Omni Firmware, Ecovacs Deebot T20 Pro Firmware and 7 more.
How do I fix CVE-2025-30198?
No fix has been published for CVE-2025-30198 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30198 being exploited?
There is no known exploitation of CVE-2025-30198 in the wild and no public exploit code.
Other vulnerabilities in ECOVACS DEEBOT T10 Series
Sources
Also known as GHSA-2hh7-5899-hfpg.