RobotRisk Autonomous Systems Incident & Risk Register
RobotRisk / Ecovacs / 2024-08

Researchers demonstrate Bluetooth/PIN flaw letting attackers hijack Ecovacs Deebot cameras and mics

S2 · 08/2024 · Ecovacs

Record

CompanyEcovacs
Categoryconsumer robotics
Typecyber
Date08/2024
Time of daynot documented
Locationno physical site (recall / fleet-wide / aggregate record)
SeverityS2 (minor injury or single-unit damage)
Scalemultiple Deebot models
Confidencehigh
VerificationCited source on file; not independently re-verified
SourceSecurity Affairs

What happened

At DEF CON 32, security researchers Dennis Giese and Braelynn Luedtke showed that a weak Bluetooth PIN implementation in Ecovacs Deebot robots let attackers connect from up to roughly 450 feet away and activate the onboard camera and microphone without the owner's knowledge.

Ecovacs record context

Entries by year and severity

122024 S2: 22242025 S1: 1125
S1S2S3S4S5

By incident type

By severity

Ecovacs vs consumer robotics alternatives

consumer robotics context

consumer robotics: entries by year

252018 S1: 11182020 S3: 11202021 S1: 11212022 S3: 11222023 S3: 22232024 S2: 22024 S4: 13242025 S1: 12025 S2: 23252026 S2: 12026 S3: 12026 S4: 12026 S5: 2526
S1S2S3S4S5

consumer robotics: failure modes

consumer robotics: most entries

cyber context

cyber: by category

cyber: by year

cyber: severity profile

Comparable cyber events in consumer robotics

SevDateCompanyEvent
S52026-07-13SharkNinjaShark robot vacuum flaw allows remote code execution via stolen certificate
S22026-05YarboSecurity vulnerability exposed in ~6,000 Yarbo robot lawn mowers
S22025-09-02Dreame TechnologySecurity flaws found in Dreame (and Ecovacs) robot vacuums with cameras
S12025-05EcovacsCISA advisory: Ecovacs Deebot base stations accept unvalidated firmware updates, deterministic WiFi key
S22024-05EcovacsHacked Ecovacs Deebot X2 vacuums shout racial slurs, chase pet in multiple US cities
S12021-09-15RoborockRoborock discloses insecure random-number generator flaw in Tuya IoT cloud connection
S12018-05-29SoftBank RoboticsSecurity researchers find Pepper robot lacks basic authentication/security controls

Other Ecovacs entries

Also from Critical Systems Analysis: CSA - functional safety engineering · Company directory · FSTalent - functional safety jobs