CVE-2025-30198— ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-30198
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK
Source: NVD (National Vulnerability Database)
Vulnerability Description
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的密码学密钥
Source: NVD (National Vulnerability Database)
Vulnerability Title
ECOVACS robot vacuums 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ECOVACS robot vacuums是中国科沃斯（ECOVACS）公司的一系列吸尘器。 ECOVACS robot vacuums存在安全漏洞，该漏洞源于使用可预测的WPA2-PSK进行不安全Wi-Fi通信。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ECOVACS | DEEBOT X1 Series | * | - | |
| ECOVACS | DEEBOT T20 Series | * | - | |
| ECOVACS | DEEBOT T10 Series | * | - | |
| ECOVACS | DEEBOT T30 Series | * | - |
II. Public POCs for CVE-2025-30198
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-30198
请登录查看更多情报信息。
Same Patch Batch · ECOVACS · 2025-09-05 · 3 CVEs total
| CVE-2025-30199 | 7.2 HIGH | ECOVACS Vacuum and Base Station accept unsigned firmware |
| CVE-2025-30200 | 6.3 MEDIUM | ECOVACS Vacuum and Base Station Hard-Coded AES Encryption |
IV. Related Vulnerabilities
Same vendor: ECOVACS
- CVE-2025-30199
ECOVACS Vacuum and Base Station accept unsigned firmware - CVE-2025-30200
ECOVACS Vacuum and Base Station Hard-Coded AES Encryption - CVE-2025-2394
Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and - CVE-2024-52327
ECOVACS lawnmower and vacuum cloud service live video PIN by - CVE-2024-12079
ECOVACS lawnmowers cleartext storage of anti-theft PIN
Same weakness: CWE-321
- CVE-2026-8243
Industrial Application Software IAS Canias ERP JNLP Deployme - CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent - CVE-2026-42518
Information Disclosure Vulnerability in e-Sushrut HMIS - CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard - CVE-2026-32644
Milesight Cameras Use of Hard-coded Cryptographic Key
V. Comments for CVE-2025-30198
No comments yet