| Ecovacs Deebot X8 Pro Omni (DEX56)
|
|
Security Grade
Calculator v1
|
Ecovacs Deebot X8 Pro Omni
Release Date: 2025-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Very common
|
🔗 Proof
|
The Korea Consumer Agency tested this exact model DEX56 in 2025 and rated device security at the lowest level, reporting relatively low hardware security and insufficient firmware security settings that expose the internal structure.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Ecovacs published a security advisory for a Bluetooth remote code execution flaw across the Deebot series, and a second advisory covering CVE-2025-30198, CVE-2025-30199 and CVE-2025-30200 where the base station releases an insecure Wi-Fi network that lets an attacker forge communication with the base station.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Researchers demonstrated full takeover at DEF CON, reading Wi-Fi credentials, stored maps and camera and microphone access, but no CVE in KEV and no mass exploitation campaign were found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Ecovacs states that it proactively pushed the fix to all active users and that devices supporting automatic updates receive system update notifications.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
Researchers reported that anyone with a phone can connect over Bluetooth from roughly 130 metres away and take control of the robot without pairing, so the proximity channel effectively has no authentication.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
CVE-2025-30198 and related issues concern the insecure Wi-Fi network released by the base station, which allows forged communication between the robot and the station.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
Researchers state that Wi-Fi credentials and saved room maps can be read from the device, indicating that stored sensitive data is not protected.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The Korea Consumer Agency found inadequate user authentication in the mobile app for this model, allowing unauthorised access or manipulation.
|
| Authentication
|
Basic
|
🔗 Proof
|
The same test reported that photos taken inside the home could be searched and stolen and that malware could be transmitted, which points to weak session and permission handling.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout for the app or the cloud API.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Cleaning history and map data are available in the app; no full security audit log is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Access depends on the ECOVACS Home cloud account; no device local password policy.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Linux (Companion App: ECOVACS Home app (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: RK3562 • GPU:
|
| Memory & Storage
|
Memory: • Storage: 220 mL dust bin, 110 mL clean water tank, 95 mL dirty water tank
|
| Power, Battery & Charging
|
Battery: Li-ion 6400 mAh • Power: Robot 14.4 V DC, 80 W; station 110-240 V AC • Charging: OMNI station with auto emptying, hot water mop washing and hot air drying
|
| Display & Camera
|
Display: • Camera: RGBD camera with dual laser solid state dToF LiDAR (TrueMapping 3.0)
|
| Sound & Connectivity
|
Sound: Microphone and speaker for YIKO-GPT voice control • Connectivity: Wi-Fi 802.11 b/g/n, Bluetooth
|
| Physical (Dimensions & Mass)
|
Dimensions: Robot approx. 353 x 352 x 98 mm; station approx. 350 x 477 x 533 mm • Mass: Robot approx. 5.3 kg; station approx. 7.6 kg
|
Overall assessment: Few devices in this batch are documented by both the vendor and a regulator for the exact same model. Ecovacs published a security advisory for Bluetooth remote code execution across the Deebot series and a second advisory covering CVE-2025-30198, CVE-2025-30199 and CVE-2025-30200, where the base station releases an insecure Wi-Fi network allowing forged communication with the robot. The Korea Consumer Agency tested this exact model DEX56 in 2025 and rated device security at the lowest level, citing low hardware security, insufficient firmware security settings exposing the internal structure, inadequate app authentication, and home photos that could be searched and stolen. Researchers at DEF CON demonstrated full takeover including Wi-Fi credentials, stored maps and camera and microphone access. The mitigating factors are that Ecovacs proactively pushed fixes to active users and no CVE appears in KEV with no mass exploitation observed, so prior attacks remain rated as rare rather than confirmed.
