Ecovacs home robots can be hacked to spy on their owners, researchers say

Security researchers found multiple serious vulnerabilities in Ecovacs robotic vacuums and lawn mowers that allow attackers to connect via Bluetooth (up to ~130 meters), deliver a payload that connects back over the internet, and gain control of devices’ cameras, microphones, local data and Wi‑Fi credentials. The flaws also include persistent data and authentication tokens on Ecovacs’ cloud even after account deletion and plaintext anti-theft PIN storage on mower hardware; researchers reported the issues to Ecovacs but say they remain unpatched.