CVE-2024-52329: ECOVACS HOME mobile app plugins do not properly validate TLS certificates

Description

ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 32% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EH

ECOVACS HOME · ECOVACS

before 3.0.0 · source: vendor

HO

Home · Ecovacs

before 3.0.0; before 3.0.0 · source: NVD