Vulnerability details
CVE-2025-30199
ECOVACS DEEBOT T10 SeriesECOVACS DEEBOT T20 SeriesECOVACS DEEBOT T30 SeriesECOVACS DEEBOT X1 Series
ECOVACS Vacuum and Base Station accept unsigned firmware
CVSS 4.0
7.5High
Official description
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 4.0 | CVEProject cvelistV5 (CNA) (cisa-cg) | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (cisa-cg) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| ECOVACS | DEEBOT T10 Series | All | CVEProject cvelistV5 (CNA) |
| ECOVACS | DEEBOT T20 Series | All | CVEProject cvelistV5 (CNA) |
| ECOVACS | DEEBOT T30 Series | All | CVEProject cvelistV5 (CNA) |
| ECOVACS | DEEBOT X1 Series | All | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-09-05
- Last updated
- 2025-09-08
- State
- Published
- Assigner (CNA)
- cisa-cg
Exploit prediction (EPSS)
0.29%
Probability of exploitation in 30 days
22.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-494Download of Code Without Integrity Check