Ecovacs Deebot N8 (N8)

Ecovacs Deebot N8 (N8)
Security Grade B Calculator v	Ecovacs Deebot N8 Brand: Ecovacs (Parent: Ecovacs Robotics Co., Ltd.) Category: Robot Vacuum • Model / Gen: Deebot N8 N8 Release Date: 2021-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Plastic chassis with screws; no public mass-tampering campaign found for this model.
Known vulnerabilities	Rare	🔗 Proof	CVE-2024-52328 affects Deebot N8 firmware: local /data warning files can be modified or deleted, CVSS 2.3 (local, high privileges). Additional Ecovacs research is public but no remote RCE was confirmed for N8.
Prior attacks	None	🔗 Proof	No public botnet or mass-exploitation campaign was found for Deebot N8; the published work is lab-based research rather than in-the-wild attacks.
Updatability	Rare	🔗 Proof	Ecovacs provides OTA/app updates, but the cadence for this older model is limited; verify the current firmware.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Device pairs with the Ecovacs cloud/app account; no mutual authentication or SSO with third-party systems.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud/app traffic uses TLS, but the device also exposes local service paths documented in the research; legacy protocol handling should be verified.
Storage	Encrypted with obselete encryption	🔗 Proof	CVE-2024-52328 shows local warning/audio files under /data can be altered; at-rest protection is legacy/limited rather than modern encryption.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Single owner account bound to the robot; no role separation or central lifecycle management.
Authentication	Basic	🔗 Proof	Email/password app login; no MFA documented.
Brute-force protection	Basic	🔗 Proof	Some rate limiting may exist at the cloud account layer; not documented as a device guarantee.
Event logging	Partial logging	🔗 Proof	App shows cleaning history and some account events; no central audit trail.
Passwords	Require change after setup	🔗 Proof	Account password is chosen at registration; default device credentials are not the primary access path.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Ecovacs firmware (Companion App: Ecovacs Home)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4 GHz
Physical (Dimensions & Mass)	Dimensions: • Mass:

Ecovacs Deebot N8 is a Wi-Fi-connected robot vacuum managed through the Ecovacs Home app and cloud account. CVE-2024-52328 documents that local warning/audio files under /data can be modified or deleted, which can hide the camera-on indication. The published exploitation requires local access and high privileges, so the rating reflects a limited but real local risk rather than a remote takeover.