CVE-2024-11147

HIGH
2025-01-23 9119a7d8-5eab-497f-8521-727c672e3725
Authentication Bypass Deebot 900 Firmware Deebot N8 Firmware Deebot T8 Firmware Deebot N9 Firmware Deebot T9 Firmware Deebot N10 Firmware Deebot T10 Firmware Deebot X1 Firmware Deebot T20 Firmware Deebot X2 Firmware Goat G1 Firmware Airbot Z1 Firmware Airbot Ava Firmware Airbot Andy Firmware
7.0
CVSS 4.0
Share

CVSS Vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:05 vuln.today
PoC Detected
Sep 23, 2025 - 17:44 vuln.today
Public exploit code
CVE Published
Jan 23, 2025 - 17:15 nvd
HIGH 7.0

Description

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.

Analysis

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. Rated high severity (CVSS 7.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical Context

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root. Affected products include: Ecovacs Deebot 900 Firmware, Ecovacs Deebot N8 Firmware, Ecovacs Deebot T8 Firmware, Ecovacs Deebot N9 Firmware, Ecovacs Deebot T9 Firmware.

Affected Products

Ecovacs Deebot 900 Firmware, Ecovacs Deebot N8 Firmware, Ecovacs Deebot T8 Firmware, Ecovacs Deebot N9 Firmware, Ecovacs Deebot T9 Firmware.

Remediation

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

Share

CVE-2024-11147 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy