“Ecovacs told the outlet in a statement that it had “identified a credential stuffing event” and blocked the IP address it originated from.”
Deebot X2 Omni owners in Minnesota, El Paso and Los Angeles heard their vacuums yell slurs, and one chased a dog. Ecovacs blamed reused passwords and blocked one IP address. Researchers showed a PIN bypass on the same model last year, and the promised security update lands in November. Blaming customers’ passwords is cheaper than shipping a login that stops them.