CVE-2025-30199

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

Score

CVSS 4.0 7.5 High

Status

Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2025-09-05

Last modified

2026-10-18

Weaknesses

CWE-494

Affected products

• Deebot T10 Firmware (Ecovacs)
• Deebot T10 Omni Firmware (Ecovacs)
• Deebot T10 Plus Firmware (Ecovacs)
• Deebot T10 Series (Ecovacs)
• Deebot T10 Turbo Firmware (Ecovacs)
• Deebot T20 Omni Firmware (Ecovacs)
• Deebot T20 Pro Firmware (Ecovacs)
• Deebot T20 Pro Plus Firmware (Ecovacs)
• Deebot T20 Series (Ecovacs)
• Deebot T30 Omni Firmware (Ecovacs)
• Deebot T30 Series (Ecovacs)
• Deebot T30s Firmware (Ecovacs)
• Deebot X1 Omni Firmware (Ecovacs)
• Deebot X1 Pro Omni Firmware (Ecovacs)
• Deebot X1 Series (Ecovacs)
• Deebot X1 Turbo Firmware (Ecovacs)
• Deebot X1s Pro Firmware (Ecovacs)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json
• https://www.cve.org/CVERecord?id=CVE-2025-30199