ECOVACS HOME Mobile App TLS Certificate Validation Vulnerability Allowing Traffic Interception and Token Theft

A vulnerability exists in the ECOVACS HOME mobile app plugins for certain robot models, where TLS certificate validation is inadequate. This flaw allows an unauthenticated attacker to intercept and potentially alter TLS traffic, leading to the unauthorized retrieval or modification of authentication tokens.

Impact

Exploitation of this vulnerability could result in interception and manipulation of TLS-encrypted traffic, allowing attackers to access or alter sensitive information, including authentication tokens.

Remediation

Users can update to the latest version of the ECOVACS HOME mobile app. For affected robot models, firmware updates are available. Instructions for updating the app or firmware can be found on the ECOVACS website or through the respective app stores.