Ecovacs

Products: Vacuum. Risk band: Elevated RobotRisk index 29.5/100 (severity- and time-weighted incidents) · ranked 6 of 13 among Consumer robotics companies with incidents (97 tracked).

Analyst brief

The record shows three cyber-related entries spanning May 2024 to May 2025: hacked Deebot units producing offensive audio and pursuing pets, a demonstrated Bluetooth/PIN flaw enabling camera hijacking, and a CISA advisory citing unvalidated firmware updates at the base-station level. The entries move from press-reported exploitation incidents to a formal government security advisory, showing escalation from isolated abuse cases to a documented systemic vulnerability. Severity is low on each entry (1-2) but the count and progression toward a CISA advisory indicate a persistent security-architecture issue rather than one-off misuse. Ecovacs's index of 29.5 ranks 6 of 13 companies in Consumer robotics with incident history.

Risk index

29.5/100RobotRisk index

26.9/100Median index across the 13 Consumer robotics companies with incident history (97 tracked, 84 with none)

6 of 13Rank in Consumer robotics (of 13 with incident history)

ElevatedRisk band

Incident timeline

Comparisons over time

Per-type breakdown

Incident type	Unique incidents	Share
cyber	3	100%

Unique incident list

3 unique incidents on file for this company.

Sev	Date	Type	Location	Incident	Source
S1	~May 2025	cyber	—	CISA advisory: Ecovacs Deebot base stations accept unvalidated firmware updates, deterministic WiFi key · Deebot Goat G1, Deebot 900/N8/T8 and related models	CISA
S2	~Aug 2024	cyber	—	Researchers demonstrate Bluetooth/PIN flaw letting attackers hijack Ecovacs Deebot cameras and mics · multiple Deebot models	Security Affairs
S2	~May 2024	cyber	—	Hacked Ecovacs Deebot X2 vacuums shout racial slurs, chase pet in multiple US cities · at least 2 households across multiple cities	Tom's Guide