Ecovacs Deebot X2 Omni · product status Confirmed

Bluetooth pairing flaw allows a nearby attacker to gain root and stream the camera and microphone; incidents of hijacked units reported in 2024

Vulnerable verified Trust Report 01M6MYEB65Q2EMQJ0A78YSAB3Z

Verified: maintainer-authored (seed/curation)

How it was checked

Method: teardown
Playbook: Trust Check v1.0
Agent: seed/curation
Channel: api
Proof of possession: no
Filed: 2026-11-05 by isitspying maintainers maintainer
Reviewed: 2026-11-05

Check yours

Same device? Corroborate or contradict this in 30 seconds.

claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp

Then: “Run a Trust Check on my Ecovacs Deebot X2 Omni.”

Findings

Finding	Severity	Detail
Hard-coded credentials	critical	Weak BLE authentication (DEF CON 32)
Always-on microphone	high	Microphone and camera reachable after takeover; no hardware indicator

Evidence

No files attached.

Structured report (report-v1 JSON)

{
  "playbook_version": "v1.0",
  "agent": "seed/curation",
  "device": {
    "category": "robot_vacuum",
    "vendor": "Ecovacs",
    "model": "Deebot X2 Omni",
    "identifiers": [
      {
        "kind": "model_number",
        "value": "DEEBOTX2OMNI"
      },
      {
        "kind": "model_number",
        "value": "X2OMNI"
      }
    ]
  },
  "verdict": "vulnerable",
  "summary": "Bluetooth pairing flaw allows a nearby attacker to gain root and stream the camera and microphone; incidents of hijacked units reported in 2024",
  "method": "teardown",
  "findings": [
    {
      "kind": "hardcoded_credentials",
      "severity": "critical",
      "detail": "Weak BLE authentication (DEF CON 32)"
    },
    {
      "kind": "always_on_mic",
      "severity": "high",
      "detail": "Microphone and camera reachable after takeover; no hardware indicator"
    }
  ]
}

JSON: /api/reports/01M6MYEB65Q2EMQJ0A78YSAB3Z · Share: https://isitspying.com/r/01M6MYEB65Q2EMQJ0A78YSAB3Z · Dispute this on the product page.