Back to CVE records
High 7.2Published Sep 5, 2025
CVE-2025-30199ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
Updated under an hour ago ()
Does this affect you?
It affects ecovacs deebot_x1s_pro_firmware and 12 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
- CVSS
- 7.2 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-494
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
ecovacs deebot_x1s_pro_firmware ecovacs:deebot_x1s_pro_firmware | before 2.5.38; before 2.4.45; before 2.4.45 | NVD |
ecovacs deebot_x1_pro_omni_firmware ecovacs:deebot_x1_pro_omni_firmware | before 2.5.38 | NVD |
ecovacs deebot_x1_omni_firmware ecovacs:deebot_x1_omni_firmware | before 2.4.45 | NVD |
ecovacs deebot_x1_turbo_firmware ecovacs:deebot_x1_turbo_firmware | before 2.5.38 | NVD |
ecovacs deebot_t10_firmware ecovacs:deebot_t10_firmware | before 1.11.0 | NVD |
ecovacs deebot_t10_omni_firmware ecovacs:deebot_t10_omni_firmware | before 1.11.0 | NVD |
ecovacs deebot_t10_plus_firmware ecovacs:deebot_t10_plus_firmware | before 1.11.0 | NVD |
ecovacs deebot_t10_turbo_firmware ecovacs:deebot_t10_turbo_firmware | before 1.11.0 | NVD |
ecovacs deebot_t20_omni_firmware ecovacs:deebot_t20_omni_firmware | before 1.25.0 | NVD |
ecovacs deebot_t20_pro_plus_firmware ecovacs:deebot_t20_pro_plus_firmware | before 1.25.0 | NVD |
ecovacs deebot_t20_pro_firmware ecovacs:deebot_t20_pro_firmware | before 1.25.0 | NVD |
ecovacs deebot_t30_omni_firmware ecovacs:deebot_t30_omni_firmware | before 1.100.0 | NVD |
ecovacs deebot_t30s_firmware ecovacs:deebot_t30s_firmware | before 1.100.0 | NVD |
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.jsonthird-party-advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19third-party-advisory, us-government-resource
- https://www.cve.org/CVERecord?id=CVE-2025-30199third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.