CVE-2025-30198

MediumCVSS 6.3/10Last modified Oct 18, 2026

Description

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-321CWE-798

Affected software

VendorProductVersions
ECOVACSDEEBOT X1 Series*
ECOVACSDEEBOT T20 Series*
ECOVACSDEEBOT T10 Series*
ECOVACSDEEBOT T30 Series*

References

Timeline

Published
Sep 5, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-301997.2ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecCVE-2025-30205.4An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configCVE-2025-302006.3ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easiCVE-2025-302019.1Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in WaCVE-2025-302027.5vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vuCVE-2025-302034.8Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) viCVE-2025-302047.5golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.PaCVE-2025-302057.6kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faultyCVE-2025-302069.8Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JCVE-2025-302077.5Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setupCVE-2025-302087.5Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` dCVE-2025-302095.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes conten
CVE-2025-30198: Medium severity, CVSS 6.3 | Vulnix