LC-3 · Consumer Risk Bulletins

Kinematic Risk Consumer Bulletin

# Kinematic Risk Consumer Bulletin

**LRRK Watch / Open-Source Intelligence** — Consumer kinematic electronics. Monthly filing.

**Issue type.** Monthly KRCB (retrospective). LC-3 (Consumer). Not the weekday 24–48h poll.

| Field | Value |
| --- | --- |
| Collection cutoff | 31 July 2025 |
| Window | 1–31 July 2025 |
| Written | 19 August 2026 (retrospective reconstruction) |
| Data label | Open-source intelligence // LRRK analytic product // retrospective monthly filing |
| Handling | Public-source material. Image rights require separate verification before publication. |
| Scope | Consumer kinematic electronics only (home, yard, companion, educational). |
| Classes in frame | Robot vacuums / mop combos · robotic lawn mowers · window-cleaning robots · pool-cleaning robots · robot pets / companion animals · social / desk companions · educational / programmable kits · robotic litter boxes · security / home patrol robots · consumer robotic arms · elder-care / assistive companions · kitchen / food-prep robots · toy / entertainment robots · niche outdoor / garden robots · emerging general-purpose or humanoid home robots |
| Spine | Reputable channels for injury, death, incidents, and safety recalls (CPSC, Health Canada, EU Safety Gate, UK OPSS, manufacturer recall pages, named newsrooms, dockets). |
| Color | Message boards, consumer forums, and Reddit — annotated context only. Never Fact without a reputable primary. |

## Executive read

### BLUF

Two official lines moved this month: the PetPivot case left the Bronx for the Southern District of New York, and CISA said mitigation was now available for every DEEBOT family listed on ICSA-25-135-19. Neither is a finding of liability or of clean installed-base patching.

### Key judgments

1. **[Assessment — High confidence]** Notice of removal in *Gome[z] et al. v. Petpivot, Inc. et al.*, S.D.N.Y. **1:25-cv-05622**, was filed **8 July 2025** from Bronx Supreme Court index 812245/2025. Judge Lewis J. Liman.
2. **[Assessment — High confidence]** CISA Update A, **10 July 2025**, states “Mitigation available for all devices.” Ecovacs’ own advisory update is dated 1 July 2025. Patch uptake is unpublished.
3. **[Inference — Moderate confidence]** Federalizing the litter-box case makes a written opinion more likely than a Bronx default. That is not a prediction of who wins.

### Analytic labels
- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades
- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution (typical for forums)

---

## 01. PetPivot case removed to S.D.N.Y. as 1:25-cv-05622

*Event / publication dates: notice of removal 8 July 2025*

**Product class.** Robotic litter boxes

**Verified record — [Fact — A1]** On **8 July 2025**, PetPivot, Inc., Poppy Xie, and Xianxue Zhou filed a notice of removal from Supreme Court of the State of New York, County of Bronx, index **812245/2025**, to the Southern District of New York as **1:25-cv-05622**. Nature of suit 365 (product liability). Judge **Lewis J. Liman**. Plaintiffs remain Stephanie Gomez and Frank Gueits; Amazon.com, Inc. remains on the caption in later docket entries. The underlying allegation is unchanged: 27 January 2025 death of cat Sarabi in a PetPivot Autoscooper 11. **No opinion this month. No finding of defect. No human injury alleged.** Sources: [PacerMonitor](https://www.pacermonitor.com/public/case/58906826/Gome_et_al_v_Petpivot,_Inc_et_al), [UniCourt](https://unicourt.com/case/ny-sue1-caseggdb500d071167-3139963).

**Threat landscape.** Same enclosure. What changed is the forum: a federal products / advertising case is now possible. Marketplace seller remains a trust path.

**Forum / community notes.**
- none independently confirmed.

**Intelligence assessment.** [Assessment — High confidence] Removal is a docket fact, not a merits fact. [Uncertainty] Whether Amazon stays in, and what claims survive a motion to dismiss, are not established this month.

**Opportunity.** The motion-to-dismiss opinion (later) is the next control. A CPSC file would still move this from advertising law into product-safety regulation.

**LRRK relevance.** Watch: 1:25-cv-05622. Passport: seller, unsupervised-safe claim, in-bowl presence method.

**Confidence.** High on the 8 July removal and case number. Low on merits.

---

## 02. CISA ICSA-25-135-19 Update A — mitigation said available for all listed DEEBOTs

*Event / publication dates: Ecovacs advisory update 1 July 2025; CISA Update A 10 July 2025*

**Product class.** Robot vacuums / mop combos

**Verified record — [Fact — A1]** CISA **Update A** to ICSA-25-135-19, dated **10 July 2025**, states: “Mitigation available for all devices.” The opened advisory still names hard-coded cryptographic keys (CVE-2025-30198, CVE-2025-30200) and unsigned over-the-air updates to the base station (CVE-2025-30199, CVSS v4 8.6). Affected families remain X1, T10, T20, T30 series below listed versions. Impact sentence unchanged: successful exploitation “could allow an attacker to send malicious updates to the devices or execute code.” “No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.” Ecovacs’ own advisory **Update Date: 1 July 2025** repeats the patched-version table and the “proactively pushed” claim. This filing **states impact only**. No exploit steps. Sources: [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19), [Ecovacs DSA](https://www.ecovacs.com/global/userhelp/dsa20250509001).

**Threat landscape.** The official residue is now “a patch exists,” not “the installed base is clean.” Unsigned dock OTA and serial-derived keys remain the Control Fabric items until uptake is measured.

**Forum / community notes.**
- none independently confirmed.

**Intelligence assessment.** [Assessment — High confidence] Update A is a status change on the advisory, not a census of patched robots. [Uncertainty] Patch uptake. Known-exploited status: not listed as of this month’s opened page.

**Opportunity.** Any CISA known-exploited listing, or a vendor statement with uptake numbers.

**LRRK relevance.** Watch: ICSA-25-135-19. Passport: patched version as a field. Lab: leftover-token and indicator integrity remain tests, not footnotes to a CVSS score.

**Confidence.** High on Update A wording and dates. Low on installed-base coverage.

---

## Forward indicators

Ranked watchlist as of 31 July 2025.

1. Motion to dismiss and any written opinion in 1:25-cv-05622.
2. ICSA-25-135-19 known-exploited status and any uptake number.
3. Scuba S1 / Zodiac field aging through the northern-hemisphere swim season.
4. Any official floor robot-vac fire recall (still none found).
5. First consumer home-humanoid pre-order with a price — none this month.

> **Collection integrity.** Two sourced signals. No new CPSC or Health Canada consumer-robot recall dated July 2025 was found. Impact-only rule held on the Ecovacs page: no payloads or reproduction procedures.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C3</span></p>