ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
Affected Platforms
Ecovacs Deebot X1 Omni FirmwareEcovacs Deebot X1E OmniEcovacs Mate X FirmwareEcovacs Deebot X2 OmniEcovacs Deebot T10Ecovacs Deebot X2 ProEcovacs Deebot X1 Pro OmniEcovacs Deebot X1 PlusEcovacs Mate XEcovacs Deebot T10 Plus Firmware