Description

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-10T09:17:23.350Z",
  "pubdate": "2026-08-10T09:17:23.350Z",
  "executiveSummary": "The ECOVACS PRO App for Android and iOS suffers from an improper server certificate validation vulnerability. This security flaw allows malicious actors to intercept, retrieve, and alter network communications between the mobile application and backend servers. The vulnerability exposes sensitive data transmitted during sessions to potential eavesdropping and tampering. Attackers capable of positioning themselves in a network path, such as through Adversary-in-the-Middle (AitM) techniques, can exploit this weakness. The risk implications include potential unauthorized data access, session hijacking, and command manipulation without requiring elevated privileges or prior authentication. Because the application fails to adequately verify the authenticity of SSL/TLS certificates presented by remote servers, secure communication channels are compromised, undermining the integrity and confidentiality of the entire mobile application ecosystem for affected users.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation or complete omission of robust X.509 certificate validation logic within the network communication stack of the ECOVACS PRO App. When the mobile application establishes secure HTTPS or TLS connections with remote endpoints, it fails to properly validate the server's digital certificate chain, hostname, or revocation status. This programmatic failure typically manifests as trusting self-signed certificates, ignoring invalid signature errors, or implementing insecure TrustManager configurations that accept any presented certificate.\nThe attack flow proceeds as follows. An attacker with network proximity, such as on the same local Wi-Fi network or controlling an upstream routing node, initiates an Adversary-in-the-Middle (AitM) position. As the ECOVACS PRO App attempts to communicate with backend servers, the attacker intercepts the TLS handshake. Because the application fails to enforce strict server certificate validation, it accepts the attacker's fraudulent or self-signed certificate as legitimate. Once the trust relationship is established, the secure tunnel terminates at the attacker's proxy rather than the intended destination server.\nThrough this interception, the attacker can decrypt, inspect, modify, and re-encrypt all HTTP/HTTPS traffic flowing between the Android or iOS application and the infrastructure. This enables the retrieval of sensitive user data, authentication tokens, and device control commands, as well as the alteration of payloads in transit to inject malicious instructions. The vulnerable components are the network communication libraries and custom SSL pinning implementations within the ECOVACS PRO App across both Android and iOS platforms. Exploitation requires network positioning and occurs dynamically during runtime execution without necessitating prior authentication or administrative privileges."
}