ECOVACS PRO App EUVD-2026-55117

Exploitation requires the attacker to achieve a man-in-the-middle network position between the victim's mobile device and the ECOVACS Robotics backend infrastructure - for example via ARP spoofing on a shared LAN, a rogue Wi-Fi access point, or DNS hijacking on a compromised upstream router. The CVSS AC:H metric encodes this network positioning requirement as the primary complexity factor. The victim's device must have the ECOVACS PRO app actively communicating with the backend (e.g., during app launch, robot control, or background telemetry sync). No special configuration of the app is required, and no privileged access to the victim device is needed. Exploitation is bounded by the necessity of local network proximity or ISP-level interception - purely remote exploitation without prior network positioning is not feasible given the MITM prerequisite.

The CVSS 3.1 base score of 4.8 (Medium) is consistent with the underlying mechanics: AV:N reflects that the attack is initiated over the network, while AC:H captures the attacker's requirement to achieve a MITM network position - a meaningful operational barrier. PR:N and UI:N indicate no privileges or explicit user interaction beyond routine app usage are needed on the attacker side. The unchanged scope (S:U) and limited C:L/I:L impact reflect that only the app's own communications are exposed, without privilege escalation or system-level compromise. EPSS data was not provided in the available intelligence, precluding probabilistic exploitation forecasting. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, together suggesting mass opportunistic exploitation is not currently observed. The realistic threat profile is targeted: a motivated actor at a shared network location - for example, even a mid-sized municipal IT team in bytom managing smart facility-cleaning devices on a shared guest VLAN would face plausible exposure from an insider or rogue AP scenario - but the AC:H MITM positioning requirement meaningfully limits drive-by or remote mass exploitation. Overall, this is a genuine medium-priority issue for organizations that use the app on shared or untrusted networks, not a high-urgency patch emergency.

An attacker on the same local network as a victim running the ECOVACS PRO app - for example, using a rogue Wi-Fi access point or ARP spoofing on a shared LAN - intercepts the TLS handshake between the app and ECOVACS backend servers and presents an attacker-controlled certificate. Because the app fails to properly validate the certificate, it accepts the connection, and the attacker can decrypt, read, and modify all subsequent app-server traffic, potentially capturing session tokens, robot control commands, or home network details. No public exploit code has been identified at time of analysis, though standard MITM tooling such as mitmproxy or Bettercap is sufficient to carry out this class of attack.