(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Ecovacs Deebot N8 (N8)
|
|
Security Grade
Calculator v1
|
Ecovacs Deebot N8
Release Date: 2021-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Plastic chassis with screws; no public mass-tampering campaign found for this model.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2024-52328 affects Deebot N8 firmware: local /data warning files can be modified or deleted, CVSS 2.3 (local, high privileges). Additional Ecovacs research is public but no remote RCE was confirmed for N8.
|
| Prior attacks
|
None
|
🔗 Proof
|
No public botnet or mass-exploitation campaign was found for Deebot N8; the published work is lab-based research rather than in-the-wild attacks.
|
| Updatability
|
Rare
|
🔗 Proof
|
Ecovacs provides OTA/app updates, but the cadence for this older model is limited; verify the current firmware.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Device pairs with the Ecovacs cloud/app account; no mutual authentication or SSO with third-party systems.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Cloud/app traffic uses TLS, but the device also exposes local service paths documented in the research; legacy protocol handling should be verified.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
CVE-2024-52328 shows local warning/audio files under /data can be altered; at-rest protection is legacy/limited rather than modern encryption.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Single owner account bound to the robot; no role separation or central lifecycle management.
|
| Authentication
|
Basic
|
🔗 Proof
|
Email/password app login; no MFA documented.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Some rate limiting may exist at the cloud account layer; not documented as a device guarantee.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
App shows cleaning history and some account events; no central audit trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Account password is chosen at registration; default device credentials are not the primary access path.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Ecovacs firmware (Companion App: Ecovacs Home)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 2.4 GHz
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Ecovacs Deebot N8 is a Wi-Fi-connected robot vacuum managed through the Ecovacs Home app and cloud account. CVE-2024-52328 documents that local warning/audio files under /data can be modified or deleted, which can hide the camera-on indication. The published exploitation requires local access and high privileges, so the rating reflects a limited but real local risk rather than a remote takeover.
