Executive brief
The ECOVACS PRO mobile app, used to control and monitor robotic vacuum cleaners, fails to properly validate server certificates during communication. This allows attackers to intercept and modify communications between the app and backend servers without detection, potentially exposing sensitive user data (floor maps, activity logs) or enabling unauthorized control of the connected robot.
Technical details
The vulnerability is a CWE-295 improper server certificate verification issue in the Android and iOS versions of the ECOVACS PRO app. During TLS/SSL connections to backend servers, the application does not properly validate the server's certificate chain, making it susceptible to man-in-the-middle (MITM) attacks. An attacker positioned on the network path (or via DNS spoofing/ARP poisoning) can intercept encrypted communications and either eavesdrop on sensitive data or inject malicious responses. No authentication bypass or local access is required—the attack occurs on the network layer. The vulnerability affects app versions prior to 1.3.82; patched versions implementing proper certificate validation are available.
Affected products
- ECOVACS ROBOTICS ECOVACS PRO Android and iOS prior to 1.3.82
Timeline
- 2026-07-31: disclosed
- 2026-08-04: advisory: JVN updated with corrections
- 2026-01-31: patched: Version 1.3.82 released with fixes