CVE-2025-30199

moderate-risk
Published 2025-09-05

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (13)

Deebot X1S Pro Firmware
Deebot X1 Pro Omni Firmware
Deebot X1 Omni Firmware
Deebot X1 Turbo Firmware
Deebot T10 Firmware
Deebot T10 Omni Firmware
Deebot T10 Plus Firmware
Deebot T10 Turbo Firmware
Deebot T20 Omni Firmware
Deebot T20 Pro Plus Firmware
Deebot T20 Pro Firmware
Deebot T30 Omni Firmware
Deebot T30S Firmware

Affected Vendors

Ecovacs

References (3)

Third Party Advisory https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-13...
Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19
Third Party Advisory https://www.cve.org/CVERecord?id=CVE-2025-30199
43
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 0/34 · Minimal
Exposure 17/34 · Moderate