Chris Anderson

**Name of the Vulnerable Software and Affected Versions** ECOVACS vacuum robot base stations (affected versions not specified) **Description** ECOVACS vacuum robot base stations do not validate firmware updates, allowing malicious over-the-air updates to be sent to the base station via an insecure connection between the robot and the base station. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ECOVACS robot vacuums and base stations (affected versions not specified) **Description** ECOVACS robot vacuums and base stations communicate over an insecure Wi-Fi network using a predictable WPA2-PSK. This allows for easy derivation of the Wi-Fi password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ECOVACS robot vacuums and base stations (affected versions not specified) **Description** ECOVACS robot vacuums and base stations communicate over an insecure Wi-Fi network. The communication utilizes AES encryption with a deterministic key that can be easily derived. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ECOVACS robot lawnmowers and vacuums (affected versions not specified) **Description** The issue concerns command injection via the `SetNetPin()` function over an unauthenticated Bluetooth Low Energy (BLE) connection. This allows for potential exploitation without the need for authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.