CVE-2025-44251 identifies a security weakness in Ecovacs Deebot T10 version 1.7.2, where Wi-Fi credentials are sent unencrypted during device pairing. This cleartext transmission (CWE-319) enables an attacker on the same network to capture these credentials, compromising Wi-Fi network confidentiality. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without affecting integrity or availability. There is no known exploit in the wild and no official patch or fix has been published to date.

The vulnerability allows an unauthenticated remote attacker to intercept Wi-Fi credentials in cleartext during the pairing process, leading to a complete compromise of Wi-Fi network confidentiality. This could enable unauthorized network access or further attacks leveraging the compromised credentials. There is no impact on integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid pairing the device on untrusted or public networks to reduce the risk of credential interception.