CVE-2025-30200 ECOVACS Vacuum and Base Station Hard-Coded AES Encryption
Attackers can decrypt Wi-Fi communications between ECOVACS robot vacuums and base stations using a deterministic AES key, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30200?
CVE-2025-30200 is a low-severity vulnerability in ECOVACS DEEBOT T10 Series, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
Which versions are affected by CVE-2025-30200?
It affects 13 products.
Products include Ecovacs Deebot T10 Firmware, Ecovacs Deebot T10 Omni Firmware, Ecovacs Deebot T10 Plus Firmware, Ecovacs Deebot T10 Turbo Firmware, Ecovacs Deebot T20 Omni Firmware, Ecovacs Deebot T20 Pro Firmware and 7 more.
How do I fix CVE-2025-30200?
No fix has been published for CVE-2025-30200 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30200 being exploited?
There is no known exploitation of CVE-2025-30200 in the wild and no public exploit code.
Other vulnerabilities in ECOVACS DEEBOT T10 Series
Sources
Also known as GHSA-4xjv-rh5p-qv86.