CVE-2024-12078 in Robot Lawn Mower
Summary
by MITRE • 01/23/2025
ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2025
The vulnerability identified as CVE-2024-12078 represents a critical security flaw in ECOVACS robotic lawn mowers and vacuum cleaners that utilize Bluetooth Low Energy communication protocols. This issue stems from the implementation of a shared static secret key for encrypting Generic Attribute Profile (GATT) messages exchanged between the robotic devices and their associated mobile applications. The fundamental weakness lies in the cryptographic design where multiple devices within the same network or ecosystem share identical encryption keys, creating a single point of failure that undermines the security of the entire product line.
The technical implementation of this vulnerability allows any unauthenticated attacker within Bluetooth range to exploit the static key mechanism and gain full control over affected robotic devices. This represents a severe violation of the principle of least privilege and demonstrates poor key management practices that are commonly addressed in industry security frameworks. The static nature of the encryption key means that once an attacker discovers or intercepts the secret, they can decrypt all communications and potentially inject malicious commands into the device's operational parameters. This flaw directly maps to CWE-327, which addresses the use of weak cryptographic algorithms and improper key management practices in security implementations.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete device compromise and potential safety risks. An attacker could remotely control the movement of robotic mowers, potentially causing property damage or personal injury through uncontrolled operation in residential or commercial environments. The vulnerability affects the device's integrity and availability, as attackers could potentially disrupt normal operations or cause devices to malfunction in dangerous ways. This type of attack vector aligns with ATT&CK technique T1059.001 for command and control through remote execution capabilities, and T1485 for data manipulation or device compromise.
Mitigation strategies for this vulnerability should focus on immediate remediation through firmware updates that implement dynamic key generation or unique device-specific encryption keys. Organizations and consumers should disable Bluetooth functionality when not in use and maintain strict physical security controls around robotic devices. The implementation of proper authentication mechanisms, including device pairing protocols and mutual authentication, would significantly reduce the attack surface. Additionally, network segmentation and monitoring for unauthorized BLE communications should be implemented to detect potential exploitation attempts. This vulnerability highlights the importance of following secure development lifecycle practices and emphasizes the need for robust key management protocols as outlined in NIST SP 800-57 and ISO/IEC 15408 standards for cryptographic key management.