- Changes
- 2
- Tracking since
- Feb 2024
- Latest
- Aug 9, 2024
- Net movement
- Classification stable
- 2024
-
Security research identifies Ecovacs Deebot Bluetooth attack surface affecting Ozmo line
Security researcher Dennis Giese published findings documenting a Bluetooth-range attack surface across Ecovacs Deebot robot vacuums, including models sharing the Ozmo 950 radio architecture.
Full assessment4 claims · 3 technical notes · 2 sources
Where it standsAutonomy LadderIIIIIIIVVLevel IIIConditional AutonomyHuman ReadinessReady NowNew to MarketWaitKnown IssuesNot ratedRobovations Score↓ moved by this entry04055708560CapableWhat happenedThe vulnerability allows an attacker within Bluetooth range to connect to the robot without authentication and access its audio and camera channels. Ecovacs issued no firmware patch for the Ozmo 950; the model's 2021 firmware freeze makes remediation unavailable.
Bottom lineThe Ozmo 950's Bluetooth attack surface is unpatched and permanent; owners should assess room placement relative to exterior walls and proximity to public spaces.
ImpactOn autonomy
- No change to autonomous cleaning operation; vulnerability is a remote-access attack vector.
- Bluetooth radio cannot be disabled via firmware on the Ozmo 950.
On readiness
- Unpatched Bluetooth vulnerability adds privacy and security risk for homes with the unit active.
- No firmware remediation path available for discontinued model; risk is permanent without hardware mitigation.
Claim check4 maker claims checked against the record. Open one to read the finding.
Ecovacs robots secured by Ecovacs Home app login and encryption
Documented findingSecurity research documents Bluetooth pairing attack surface operable without app credentials; attacker within ~100 meters can connect to radio without authentication per published findingsCamera and audio features protected by account authentication
Documented findingResearch documents audio and camera channel access reachable via Bluetooth exploit without account login on affected Deebot modelsEcovacs issues timely security updates for its robot line
Documented findingEcovacs confirmed awareness of findings and stated patches would be issued for current models; Ozmo 950 discontinued in 2021 and not included in patch scopeBluetooth connectivity enhances setup convenience
Documented findingBluetooth radio operates continuously during use as a persistent attack surface; no user-accessible disable toggle in firmwareEvidence2 sources · all linked
12Jul 2024Aug 2024filed 9 Aug 2024Technical notes3 sectionsVulnerability Summary
Security researcher Dennis Giese, presenting findings covered by Consumer Reports, ABC News, and TechCrunch in July 2024, documented a Bluetooth authentication bypass affecting multiple Ecovacs Deebot models. The attack operates within Bluetooth Low Energy range (up to approximately 100 meters line-of-sight per research documentation) and does not require knowledge of the owner’s Ecovacs account credentials.
Ozmo 950 Exposure
The Ozmo 950 uses Bluetooth (confirmed in manufacturer specifications and the unit’s connectivity list) for initial setup pairing. The model shares its radio architecture with the broader Deebot line identified in research coverage. Ecovacs’ public response to the research acknowledged current-generation models would receive patches; the Ozmo 950 was discontinued in 2021 and falls outside Ecovacs’ stated patch scope.
No Mitigation Path
Firmware development for the Ozmo 950 ended in 2021. There is no owner-accessible toggle to disable Bluetooth operation after setup; the radio remains active during all cleaning cycles. Owners seeking to mitigate exposure have no firmware-level option; physical placement away from exterior walls is the only documented workaround cited in owner discussions.
-
Ecovacs Home app update removes scheduling features for Ozmo 950
Ecovacs pushed a revised Ecovacs Home app that dropped interactive map-editing and multi-zone scheduling for legacy Deebot models, including the Ozmo 950.
Full assessment3 claims · 3 technical notes · 2 sources
Where it standsAutonomy LadderIIIIIIIVVLevel IIIConditional AutonomyHuman ReadinessReady NowNew to MarketWaitKnown IssuesNot ratedRobovations Score↓ moved by this entry04055708560CapableWhat happenedOwner reports document loss of the custom zone-drawing and room-rename features that were part of the unit's original multi-floor mapping value proposition. Basic room-select and manual start-stop remain, but the scheduling depth that justified LiDAR mapping on this model is no longer accessible through the official app.
Bottom lineThe Ozmo 950's mapping hardware is intact but its software interface has been reduced to basic operation; the scheduling depth that distinguished it from camera-only vacuums in 2019 is no longer accessible through official channels.
ImpactOn autonomy
- Custom cleaning zone creation no longer accessible via app for this model.
- Multi-room scheduling retained at room level but timed zone sequences removed.
On readiness
- App-controlled scheduling depth reduced; manual workarounds require physical button interaction.
- Owner reports confirm basic start-stop function unaffected; advanced map customization lost.
Claim check3 maker claims checked against the record. Open one to read the finding.
LiDAR mapping enables precise room-by-room and zone-by-zone scheduling
Documented findingApp update removed interactive zone-drawing for legacy models; room-level selection retained but sub-room zone customization unavailable per owner reports on updated app versionsMulti-floor map memory provides long-term scheduling value
Documented findingMaps remain stored on unit; app interface to interact with saved maps has been reduced to read-only room-select on legacy model support tierEcovacs Home app provides consistent experience across robot generations
Documented findingApp changelog and owner reports document tiered feature access by model age; Ozmo 950 classified as legacy tier with reduced UI capability after 2024 updateEvidence2 sources · all linked
12Jan 2024Feb 2024filed 5 Feb 2024Technical notes3 sections
App Platform Context
Ecovacs introduced a revised Ecovacs Home app platform in late 2023 and early 2024, consolidating its robot lineup under a unified interface designed for current-generation models with updated onboard processors. Legacy models were retained in the app under a compatibility layer with reduced feature parity.
Feature Changes for Ozmo 950
Owner reports on Reddit r/robotvacuum and Ecovacs community forums document that following the update, the interactive map canvas for the Ozmo 950 no longer renders the zone-drawing tools (custom area creation, no-mop zone adjustment, and room-rename). Room-level selection from the stored multi-floor maps continues to function. Timed multi-zone scheduling sequences, which previously allowed owners to assign specific rooms to specific days and times, are no longer configurable in the updated app UI for this model.
Firmware Independence
The onboard LiDAR mapping and room-segmentation logic runs on the unit’s firmware, which is unaffected by the app change. The robot continues to navigate using its stored floor maps; the reduction is in the app’s interface layer, not in the unit’s mapping capability. Owners using third-party integrations (Home Assistant via local API) report map and room-select functionality accessible outside the official app.