# ECOVACS DEEBOT vacuums vulnerable to remote code execution

Published: 2025-07-10 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/7a97dee8-59ae-5694-80f2-e72159518a0d/ecovacs-deebot-vacuums-vulnerable-to-remote-code-execution

> Hardcoded encryption keys and missing firmware validation in ECOVACS vacuums allow remote code execution; patches available.

CISA has published an advisory on three vulnerabilities affecting ECOVACS DEEBOT vacuum and base station devices across multiple product lines (X1S PRO, X1 PRO OMNI, X1 OMNI, X1 TURBO, T10/T20/T30 Series). The vulnerabilities stem from deterministic hardcoded cryptographic keys derived from device serial numbers (CVE-2025-30198, CVE-2025-30200) and a lack of firmware integrity validation on base stations (CVE-2025-30199). An attacker within Wi-Fi range can derive the encryption key from the serial number and send malicious firmware updates to the base station without authentication.

Successful exploitation allows an attacker to execute arbitrary code on the affected devices. The highest CVSS v4 score is 8.6 for the firmware validation flaw. ECOVACS has released patches for all affected devices and has proactively pushed updates to users. No known public exploitation of these vulnerabilities has been reported to CISA as of the advisory update in July 2025. Defenders should ensure all ECOVACS devices are updated to the specified patched versions and network-segment these devices to prevent unauthorized access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-30198, CVE-2025-30199, CVE-2025-30200

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7a97dee8-59ae-5694-80f2-e72159518a0d/ecovacs-deebot-vacuums-vulnerable-to-remote-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup