CVE-2025-30199 ECOVACS Vacuum and Base Station accept unsigned firmware
Attackers can execute arbitrary code on ECOVACS base stations by sending unsigned firmware updates over an insecure connection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30199?
CVE-2025-30199 is a high-severity code injection vulnerability in ECOVACS DEEBOT T10 Series, published on 5 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
Weakness: CWE-494
Which versions are affected by CVE-2025-30199?
It affects 13 products.
Products include Ecovacs Deebot T10 Firmware, Ecovacs Deebot T10 Omni Firmware, Ecovacs Deebot T10 Plus Firmware, Ecovacs Deebot T10 Turbo Firmware, Ecovacs Deebot T20 Omni Firmware, Ecovacs Deebot T20 Pro Firmware and 7 more.
How do I fix CVE-2025-30199?
No fix has been published for CVE-2025-30199 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-30199 being exploited?
There is no known exploitation of CVE-2025-30199 in the wild and no public exploit code.
Other vulnerabilities in ECOVACS DEEBOT T10 Series
Sources
Also known as GHSA-2hqv-x23m-4c88.