# CVE-2025-44251: Ecovacs Deebot T10 cleartext Wi-Fi credential transmission during pairing

Source: https://junglewise.ai/threats/cve-2025-44251-ecovacs-deebot-t10-cleartext-wi-fi-credential-transmission-during  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-10. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-44251 · Severity: high · CVSS 7.5 · Published 2025-07-10

The Ecovacs Deebot T10 robotic vacuum cleaner transmits the user's home Wi-Fi password in an unencrypted format during the initial setup and pairing process. An attacker physically near the device during setup could intercept this information by monitoring the temporary Wi-Fi network created by the vacuum. This could allow an unauthorized individual to gain access to the owner's private home network and any other connected devices.

Vendors: [Ecovacs](https://junglewise.ai/threats/vendors/ecovacs).

## Quick answers

**Is CVE-2025-44251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-44251 being exploited in the wild.

**How severe is CVE-2025-44251?** High severity, with a CVSS score of 7.5, published 10 July 2025.

**Which products and versions are affected?** Ecovacs Deebot T10 1.7.2, 1.7.5; Ecovacs Home 3.0.0, 3.4.0.

**Is there a fix for CVE-2025-44251?** A patch was published on 2025-05-06: Vendor claimed server-side and app updates were completed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-44251 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2025-44251?** Check whether you run Ecovacs Deebot T10 or Ecovacs Home at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cleartext transmission of sensitive information (CWE-319) exists in the Ecovacs Deebot T10 pairing workflow. During setup, the vacuum creates an unencrypted (open) Wi-Fi Access Point to communicate with the mobile application. The Ecovacs Home iOS app then transmits the user's home Wi-Fi SSID and password to the vacuum's /rcp.do endpoint using a cleartext HTTP POST request. An attacker within Wi-Fi range can sniff this traffic to obtain the credentials. Although the vendor claimed a server-side and app-side fix was deployed in mid-2025, researchers reported the vulnerability persisted in Deebot firmware 1.7.5 and iOS app 3.4.0.

## Affected products

- Ecovacs Deebot T10 1.7.2, 1.7.5
- Ecovacs Ecovacs Home iOS App 3.0.0, 3.4.0

## Timeline

- 2024-11-13: disclosed: Initial contact with Ecovacs support.
- 2024-12-04: other: Vulnerability confirmed by Ecovacs.
- 2025-05-06: patched: Vendor claimed server-side and app updates were completed.
- 2025-06-25: other: Researcher verified the vulnerability still exists in latest versions.
- 2025-07-09: advisory: Public disclosure by researcher.
- 2025-07-10: advisory: NVD publication date.

## References

- [https://httpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com/2025/07/09/CVE-2025-44251.html](https://httpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com/2025/07/09/CVE-2025-44251.html)