CVE-2024-11147 - Vulnerability Details

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Ecovacs	Airbot Andy Airbot Andy Firmware Airbot Ava Airbot Ava Firmware Airbot Z1 Airbot Z1 Firmware Deebot 900 Deebot 900 Firmware Deebot N10 Deebot N10 Firmware Deebot N8 Deebot N8 Firmware Deebot N9 Deebot N9 Firmware Deebot T10 Deebot T10 Firmware Deebot T20 Deebot T20 Firmware Deebot T8 Deebot T8 Firmware Deebot T9 Deebot T9 Firmware Deebot X1 Deebot X1 Firmware Deebot X2 Deebot X2 Firmware Goat G1 Goat G1 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:ecovacs:deebot_900_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_900:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:ecovacs:deebot_n8_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_n8:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:ecovacs:deebot_t8_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_t8:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:ecovacs:deebot_n9_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_n9:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:ecovacs:deebot_t9_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_t9:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:ecovacs:deebot_n10_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_n10:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:ecovacs:deebot_t10_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_t10:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:ecovacs:deebot_x1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_x1:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:ecovacs:deebot_t20_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_t20:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:ecovacs:deebot_x2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:deebot_x2:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:ecovacs:goat_g1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:goat_g1:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:ecovacs:airbot_z1_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:airbot_z1:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:ecovacs:airbot_ava_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:airbot_ava:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:ecovacs:airbot_andy_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ecovacs:airbot_andy:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://builder.dontvacuum.me/ecopassword.php
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf

History

Tue, 23 Sep 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ecovacs Ecovacs airbot Andy Ecovacs airbot Andy Firmware Ecovacs airbot Ava Ecovacs airbot Ava Firmware Ecovacs airbot Z1 Ecovacs airbot Z1 Firmware Ecovacs deebot 900 Ecovacs deebot 900 Firmware Ecovacs deebot N10 Ecovacs deebot N10 Firmware Ecovacs deebot N8 Ecovacs deebot N8 Firmware Ecovacs deebot N9 Ecovacs deebot N9 Firmware Ecovacs deebot T10 Ecovacs deebot T10 Firmware Ecovacs deebot T20 Ecovacs deebot T20 Firmware Ecovacs deebot T8 Ecovacs deebot T8 Firmware Ecovacs deebot T9 Ecovacs deebot T9 Firmware Ecovacs deebot X1 Ecovacs deebot X1 Firmware Ecovacs deebot X2 Ecovacs deebot X2 Firmware Ecovacs goat G1 Ecovacs goat G1 Firmware
CPEs		cpe:2.3:h:ecovacs:airbot_andy:-:::::::* cpe:2.3:h:ecovacs:airbot_ava:-:::::::* cpe:2.3:h:ecovacs:airbot_z1:-:::::::* cpe:2.3:h:ecovacs:deebot_900:-:::::::* cpe:2.3:h:ecovacs:deebot_n10:-:::::::* cpe:2.3:h:ecovacs:deebot_n8:-:::::::* cpe:2.3:h:ecovacs:deebot_n9:-:::::::* cpe:2.3:h:ecovacs:deebot_t10:-:::::::* cpe:2.3:h:ecovacs:deebot_t20:-:::::::* cpe:2.3:h:ecovacs:deebot_t8:-:::::::* cpe:2.3:h:ecovacs:deebot_t9:-:::::::* cpe:2.3:h:ecovacs:deebot_x1:-:::::::* cpe:2.3:h:ecovacs:deebot_x2:-:::::::* cpe:2.3:h:ecovacs:goat_g1:-:::::::* cpe:2.3:o:ecovacs:airbot_andy_firmware:-:::::::* cpe:2.3:o:ecovacs:airbot_ava_firmware:-:::::::* cpe:2.3:o:ecovacs:airbot_z1_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_900_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n10_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n8_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_n9_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t10_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t20_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t8_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_t9_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_x1_firmware:-:::::::* cpe:2.3:o:ecovacs:deebot_x2_firmware:-:::::::* cpe:2.3:o:ecovacs:goat_g1_firmware:-:::::::*
Vendors & Products		Ecovacs Ecovacs airbot Andy Ecovacs airbot Andy Firmware Ecovacs airbot Ava Ecovacs airbot Ava Firmware Ecovacs airbot Z1 Ecovacs airbot Z1 Firmware Ecovacs deebot 900 Ecovacs deebot 900 Firmware Ecovacs deebot N10 Ecovacs deebot N10 Firmware Ecovacs deebot N8 Ecovacs deebot N8 Firmware Ecovacs deebot N9 Ecovacs deebot N9 Firmware Ecovacs deebot T10 Ecovacs deebot T10 Firmware Ecovacs deebot T20 Ecovacs deebot T20 Firmware Ecovacs deebot T8 Ecovacs deebot T8 Firmware Ecovacs deebot T9 Ecovacs deebot T9 Firmware Ecovacs deebot X1 Ecovacs deebot X1 Firmware Ecovacs deebot X2 Ecovacs deebot X2 Firmware Ecovacs goat G1 Ecovacs goat G1 Firmware

Wed, 12 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 23 Jan 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.
Title		ECOVACS lawnmowers and vacuums deterministic root password
Weaknesses		CWE-798
References		https://builder.dontvacuum.me/ecopassword.php https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
Metrics		cvssV3_1 `{'score': 7.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 7, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published: 2025-01-23T16:37:54.479Z

Updated: 2025-02-12T17:07:28.749Z

Reserved: 2024-11-12T15:39:13.966Z

Link: CVE-2024-11147

Vulnrichment

Updated: 2025-02-12T17:07:20.320Z

NVD

Status : Analyzed

Published: 2025-01-23T17:15:12.860

Modified: 2025-09-23T17:44:13.273

Link: CVE-2024-11147

Redhat

No data.

Metrics

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object