Hijacked Ecovacs Deebot X2 robot vacuums shout slurs in US homes

What happened

On May 24, 2024, a lawyer in Minnesota noticed his Ecovacs Deebot X2 robot vacuum behaving oddly while he watched television. The companion app showed that someone he did not know was using the robot’s live camera feed and remote-control feature. He reset his password and restarted the robot, but it began moving again, and a voice came through its speaker shouting racial slurs with family present. He switched it off.

On the same day, a Deebot X2 in Los Angeles was steered around a home by a remote user, chasing the owner’s dog while abusive comments were played through the speaker. Five days later an Ecovacs robot in El Paso shouted racial slurs at its owner late at night until he unplugged it.

The events were first reported in October 2024 by the Australian Broadcasting Corporation, which spoke to affected owners and to Ecovacs. It is not known how many devices were accessed in total.

The system involved

The Deebot X2 is a household robot vacuum made by the Chinese company Ecovacs. It has an onboard camera and speaker, and owners can view live video and drive the robot remotely from a phone app. Access to the video feature is protected by a four-digit PIN in addition to the account password.

Two security researchers reported to Ecovacs, and presented publicly in December 2023, that the PIN was verified only by the app rather than by the server or the robot, so it could be bypassed. They also found that the audible warning played when the camera is being watched could be turned off remotely.

Investigation and response

Ecovacs told the Australian Broadcasting Corporation that its investigation found the Minnesota owner’s account and password had been obtained by an unauthorized person and that it disabled the IP address responsible. The company said there was a high possibility the account was hit by credential stuffing, in which login details leaked from other services are reused, and that it found no evidence of a breach of its own systems.

Ecovacs said it had already fixed the PIN bypass, a claim one of the researchers disputed as insufficient, and that it would release a security upgrade for X2 owners in November 2024. It said it had emailed customers asking them to change their passwords. The Minnesota owner said he was not told about the PIN weakness when the company contacted him.

What is not established

Who carried out the intrusions is not known, nor is the total number of devices affected. Ecovacs attributes at least one case to reused credentials, while researchers point to the PIN bypass as what allowed camera and remote-control access once an account was entered; the exact method used in each home has not been established. The city of the Minnesota home is not given in the reports reviewed.