EUVD-2026-55117
GHSA-945x-4wx3-jqmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MITM network positioning is required for exploitation, justifying AC:H; no target-side privileges or explicit interaction needed; impact is limited to partial interception and modification of app communications only.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
5DescriptionCVE.org
Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.
AnalysisAI
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-295 (Improper Certificate Validation) describes failures in a TLS client to correctly verify that the server's presented certificate is authentic - this can manifest as skipped hostname verification, acceptance of self-signed or expired certificates, or absence of certificate pinning. Both the Android and iOS ECOVACS PRO applications by ECOVACS Robotics are confirmed affected per CPE strings (cpe:2.3:a:ecovacs_robotics:android_app_"ecovacs_pro":*:*:*:*:*:*:*:* and cpe:2.3:a:ecovacs_robotics:ios_app_"ecovacs_pro":*:*:*:*:*:*:*:*), with wildcard versioning indicating no version boundary is defined in available data. This class of flaw is common in IoT companion applications where certificate validation may have been disabled during development or where pinning was never implemented. The ECOVACS PRO app manages ECOVACS consumer robotic cleaning devices, meaning intercepted traffic could include robot control instructions, account session tokens, Wi-Fi credentials, and home layout or scheduling data - information with meaningful privacy implications for end users.
RemediationAI
Consult the vendor advisory at https://robot.hellohas.co.jp/news/update_20260331/ to identify the patched release version and update the ECOVACS PRO application on both Android (via Google Play) and iOS (via Apple App Store) to the latest available version. The available data does not independently confirm an exact fixed version number, so users should verify against the advisory directly. As an interim compensating control prior to patching, restrict use of the ECOVACS PRO app exclusively to trusted, secured home or corporate Wi-Fi networks (e.g., WPA3-protected), avoiding operation on public or shared networks such as hotel, airport, or café Wi-Fi - this directly removes the network positioning prerequisite for exploitation without any functional trade-off. Using a trusted VPN on untrusted networks would also neutralize the MITM vector, though it introduces a dependency on VPN provider integrity.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today