Ecovacs Home Mobile Applications Sensitive Data Disclosure Vulnerability
Vulnerability
A vulnerability exists in the Ecovacs Home Android and iOS mobile applications in versions prior to 3.3.0. The issue stems from embedded access keys and secrets for Alibaba Object Storage Service (OSS), which could lead to unauthorized access or tampering with data on the server.
Impact
The embedded keys and secrets could be exploited to access or manipulate data on the Alibaba OSS without authorization.
Remediation
Users are advised to update to version 3.4.0 or later. The latest version can be downloaded from the App Store for iOS devices or the Google Play Store for Android devices. Alternatively, the latest version can be downloaded from the official Ecovacs website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.