CVE-2025-30198

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

Score

CVSS 3.1 6.3 Medium

Status

Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2025-09-05

Last modified

2026-10-18

Weaknesses

CWE-321, CWE-798

Affected products

• Deebot T10 Firmware (Ecovacs)
• Deebot T10 Omni Firmware (Ecovacs)
• Deebot T10 Plus Firmware (Ecovacs)
• Deebot T10 Series (Ecovacs)
• Deebot T10 Turbo Firmware (Ecovacs)
• Deebot T20 Omni Firmware (Ecovacs)
• Deebot T20 Pro Firmware (Ecovacs)
• Deebot T20 Pro Plus Firmware (Ecovacs)
• Deebot T20 Series (Ecovacs)
• Deebot T30 Omni Firmware (Ecovacs)
• Deebot T30 Series (Ecovacs)
• Deebot T30s Firmware (Ecovacs)
• Deebot X1 Omni Firmware (Ecovacs)
• Deebot X1 Pro Omni Firmware (Ecovacs)
• Deebot X1 Series (Ecovacs)
• Deebot X1 Turbo Firmware (Ecovacs)
• Deebot X1s Pro Firmware (Ecovacs)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json
• https://www.cve.org/CVERecord?id=CVE-2025-30198