How severe is CVE-2024-12079?

CVE-2024-12079 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-12079 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-12079?

CVE-2024-12079 primarily affects Ecovacs Deebot 900 Firmware. In total, 14 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-12079?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-12079 have an EU (EUVD) identifier?

Yes. CVE-2024-12079 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-50577.

When was CVE-2024-12079 published?

CVE-2024-12079 was published on 2025-01-23 and last updated on 2026-06-17.

CVE-2024-12079

CVE-2024-12079 is a low-severity vulnerability in Ecovacs Deebot 900 Firmware with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-312.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v4: 4.8
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-50577
Weakness: CWE-312
Affected product: Ecovacs Deebot 900 Firmware
Published: 2025-01-23
Last modified: 2026-06-17

Description

ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.

Frequently asked questions

What is CVE-2024-12079?: ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.
How severe is CVE-2024-12079?: CVE-2024-12079 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-12079 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-12079?: CVE-2024-12079 primarily affects Ecovacs Deebot 900 Firmware. In total, 14 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-12079?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-12079 have an EU (EUVD) identifier?: Yes. CVE-2024-12079 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-50577.
When was CVE-2024-12079 published?: CVE-2024-12079 was published on 2025-01-23 and last updated on 2026-06-17.

References

https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf

Affected products (14)

cpe:2.3:o:ecovacs:deebot_900_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_n8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_n9_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_t9_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_n10_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_t10_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_x1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_t20_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:deebot_x2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:goat_g1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:airbot_z1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:airbot_ava_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:ecovacs:airbot_andy_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Ecovacs Deebot 900 Firmware

CVE-2024-11147 — High (CVSS 7.6): ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An…
CVE-2024-52331 — High (CVSS 7.5): ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can…
CVE-2024-12078 — Medium (CVSS 6.3): ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated…
CVE-2024-52328 — Low (CVSS 2.3): ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker…

All CVEs affecting Ecovacs Deebot 900 Firmware →

Other CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities

CVE-2022-43757 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain…
CVE-2021-36782 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster…
CVE-2020-9045 — Critical (CVSS 9.9): During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management…
CVE-2026-31848 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which…
CVE-2025-65826 — Critical (CVSS 9.8): The mobile application was found to contain stored credentials for the network it was developed on. If an attacker…
CVE-2025-34206 — Critical (CVSS 9.8): Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host…

Browse all CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities →