Android App Ecovacs Pro
Monthly
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.