Ecovacs robot vacuums vulnerable to remote hacking via Bluetooth
Security researcher Dennis Giese discovered that Ecovacs robot vacuums have critical Bluetooth vulnerabilities allowing remote hacking from over 140 metres away. ABC News demonstrated the flaw by accessing a Deebot X2's camera, microphone, and WiFi credentials. The company had not fixed the issues after being warned in December 2023.
What happened
Security researcher Dennis Giese discovered that Ecovacs robot vacuums, including the flagship Deebot X2 model, contained critical cybersecurity flaws allowing remote hacking via Bluetooth from up to 140 metres away using only a smartphone.
ABC News demonstrated the vulnerability by gaining unauthorised access to the onboard computer and connected sensors of a Deebot X2 owned by an Australian consumer, accessing the camera, microphone, logs, and WiFi credentials.
Giese reported the security issues to Ecovacs in December 2023, but the company had not fixed them by October 2024 when ABC News published its findings.
Reported impact
The vulnerabilities exposed users' homes to surveillance through the robot's camera and microphone, with one owner describing the risk as 'like having a webcam that can roll around your house and look at your family'.
An attacker with access to the device could obtain maps of users' houses, WiFi credentials, stored photos and videos, and voice recordings.
Index analysis
The security flaws appear to stem from basic implementation errors in the device's Bluetooth connectivity, raising questions about the robustness of Ecovacs' server infrastructure.
Ecovacs collects photos, videos, and voice recordings from inside users' homes through an optional product improvement program, which it uses to train AI models. Users who opt into the program are not clearly informed what data will be collected, and the company's privacy policy allows blanket collection of user data for research purposes, including data that users delete via the app.
Governance controls
Ecovacs committed in October 2024 to fixing the security issues in its flagship robot vacuum by November 2024, and said it is 'proactively exploring more comprehensive testing methods'.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.