LC-3 · Consumer Risk Bulletins

Kinematic Risk Consumer Bulletin

# Kinematic Risk Consumer Bulletin

**LRRK Watch / Open-Source Intelligence** — Monthly filing. Consumer systems that sense, move, and act in homes and yards.

**Issue type.** Monthly (LC-3). Window = calendar month. Not the weekday 24–48h poll.

| Field | Value |
| --- | --- |
| Collection cutoff | 30 November 2024 |
| Window | 1–30 November 2024 |
| Series | KRCB-M-2024-11 |
| Status | short |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |
| Scope | Consumer kinematic electronics only (home, yard, companion, educational). |
| Spine | CPSC, Health Canada, EU Safety Gate, UK OPSS, manufacturer pages, named newsrooms, dockets. |
| Color | Forums annotated only. Never Fact without a reputable primary. |

## Executive read

### BLUF

November adds a versioned Ecovacs BLE-RCE advisory, an FTC staff paper that says missing software-support duration may violate warranty law, and the EU Safety Gate cite of Honda Miimo. None of these is a CPSC recall. The staff paper is not an enforcement action. This filing states Ecovacs impact only.

### Key judgments

1. **[Assessment — High confidence]** Ecovacs DSA pages dated 19 November (Deebot) and 30 November (Goat) exist and name patched firmware versions. They credit Dennis Giese, Braelynn Luedtke, and Chris Anderson.
2. **[Assessment — High confidence]** FTC staff, 26 November 2024: **161 of 184** surveyed smart products (89%) failed to disclose software-support duration on the manufacturer webpage. Staff paper ≠ case.
3. **[Assessment — Moderate confidence]** Safety Gate **A12/03112/24** is cited as published 8 November 2024 (France notifying; cuts; Miimo). Official Safety Gate HTML was not loaded in this collection; the cite is B2 from an aggregator.

### Analytic labels
- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades
- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

---

## 01. Honda Miimo — Safety Gate A12/03112/24 cited 8 November (B2)

*Event / publication dates: aggregator cite 8 November 2024; French measure in force 29 July 2024; UK OPSS 6 September 2024*

**Product class.** Robotic lawn mowers

**Verified record — [Fact — B2]** EU Safety Gate alert **A12/03112/24** is cited as published **8 November 2024**: Honda Miimo, category Machinery, risk type Cuts, notifying country France, models HRM1000, HRM1500, HRM2500, HRM4000. Aggregator text: a manufacturing defect in the obstruction/lift sensor’s mount shaft can cause the sensor to become stuck and fail to detect obstacles; users or bystanders, including children, can cut themselves if the collision/lift sensor stops working; does not comply with the Machinery Directive or EN 60335-1 and EN 50636-2-107; manufacturer recall from end users; date of entry into force 29 July 2024. [RecallEurope aggregator](https://recalleurope.com/alert/miimo-honda-a12-03112-24/).

**Official Safety Gate HTML was not loaded in this collection.** Holdings on the EU alert number, date, and cuts language are **B2** pending the Commission page. The UK OPSS and French Rappel Conso pages were opened in September and July and are not re-filed as new UK/FR events.

**Threat landscape.** Same stuck-shaft mechanism as the July/September official pages, now with an EU alert number attached. No injury count in the aggregator text.

**Forum / community notes.**
- none found.

**Intelligence assessment.** [Assessment — Moderate confidence] The alert number and 8 November date are consistently cited. [Uncertainty] Until the official HTML is opened, country-of-origin and full serial list on the EU page remain unverified.

**Opportunity.** Open the official Safety Gate HTML.

**LRRK relevance.** Sense / Move / Act. Watch: A12/03112/24.

**Confidence.** Moderate on the EU number and date. High that the underlying French/UK pages exist. Low on unpublished injury volume.

---

## 02. Ecovacs DSA — BLE RCE named; versioned Deebot and Goat patches

*Event / publication dates: DSA 19 November 2024 (Deebot); DSA 30 November 2024 (Goat)*

**Product class.** Robot vacuums / mop combos; robotic lawn mowers

**Verified record — [Fact — A1]** Ecovacs published a security advisory on **19 November 2024** titled “Bluetooth Remote Code Execution (BLE RCE) Vulnerability in Deebot Product Series.” “Under specific technical conditions, successful exploitation of this vulnerability could allow an attacker to remotely compromise the affected devices.” Vulnerability source named: Dennis Giese, Braelynn Luedtke, and Chris Anderson. Patched versions as printed: X2 OMNI 1.76.6; X2 COMBO 1.81.10; X2S 1.49.0; X5 PRO 1.70.0; X5 PRO PLUS 1.38.0; X5 PRO ULTRA 1.17.0; T30 OMNI 1.93.0; T30S 1.95.0. Vendor: updates pushed; users complete the fix by performing the system update. [Ecovacs DSA 20241119](https://www.ecovacs.com/global/userhelp/dsa20241119).

A second page, **30 November 2024**, names the same class of issue on Goat: GOAT G1-2000 / G1 / G1-800 patched to **1.36.187**; GX-600 to **1.2.120**. Same researchers. [Ecovacs DSA 20241130001](https://www.ecovacs.com/global/userhelp/dsa20241130001).

**This filing states impact only. It does not reproduce exploit steps, payloads, or BLE procedures.** August’s DEF CON reporting (no trustworthy hardware camera-on indicator; leftover cloud tokens) is a prior file; these DSAs name BLE RCE and versions. They do not, on their face, close leftover-token or indicator issues. CISA ICSA-25-135-19 is 2025 and is out of window. CVE-2024-52325 is a later NVD label and is not treated as a 19 November Fact.

**Threat landscape.** A camera robot or mower whose Bluetooth path the vendor now admits can be remotely compromised “under specific technical conditions.” Patch uptake on the installed base is unpublished.

**Forum / community notes.**
- none found.

**Intelligence assessment.** [Assessment — High confidence] The two DSA pages exist and list versions. [Inference — Moderate confidence] A versioned BLE fix is not a fleet statement that leftover tokens and camera-on indicators are closed. [Uncertainty] Which SKUs outside the tables remain unpatched; exploit status in the wild (not asserted as a fact on the vendor pages).

**Opportunity.** Whether a later CISA page names leftover tokens / indicators, or only BLE RCE.

**LRRK relevance.** Kestrel and Control Fabric (signed OTA, indicator integrity). Lab: patch-presence tests — not exploit reproduction.

**Confidence.** High on the dated pages and the version tables. Low on uptake and on whether the August impact list is fully in scope.

---

## 03. FTC staff paper — 161 of 184 smart products omit support duration

*Event / publication dates: 26 November 2024 (FTC staff perspective and press release)*

**Product class.** Cross-class (staff survey of “smart” products; applies to cloud-tethered consumer kinematics)

**Verified record — [Fact — A1]** FTC staff, East Central Regional Office, surveyed **184** connected products. **161** (nearly **89%**) failed to disclose on the manufacturer’s product webpage how long the product would receive software updates. Basic internet searches did not uncover support duration for **124** (about two-thirds). Samuel Levine, Director, Bureau of Consumer Protection: “Our study shows that nearly 89% of manufacturers of products we examined failed to post this information prominently or make it readily available.”

Staff: failure to inform prospective purchasers about software-update duration for products sold with written warranties **may violate** the Magnuson-Moss Warranty Act (written warranties on consumer products costing more than $15 must be available before sale and must disclose what is covered). Omissions or representations about how long a product is usable **could also violate** FTC Act §5. [FTC release, 26 November 2024](https://www.ftc.gov/news-events/news/press-releases/2024/11/smart-products-surveyed-fail-provide-consumers-information-how-long-companies-will-provide-software); [staff PDF](https://www.ftc.gov/system/files/ftc_gov/pdf/smart-device-makers-failure-to-provide-software-updates-may-leave-you-smarting.pdf).

**This is a staff paper, not an enforcement action, not a complaint, and not a finding against a named robot maker.**

**Threat landscape.** A cloud-tethered kinematic object whose personality is a server. If support duration is undisclosed, the owner cannot price the day the object becomes inert plastic. The next companion brick will be read against this paper.

**Forum / community notes.**
- none found.

**Intelligence assessment.** [Assessment — High confidence] The 161/184 and 124 figures are the staff counts. [Inference — Moderate confidence] A no-refund companion brick in the next weeks would sit on this theory. [Uncertainty] Whether any named robot SKU was in the 184 is unpublished in the release.

**Opportunity.** An FTC or state-AG complaint that cites a named robot against this paper.

**LRRK relevance.** Passport: warranty and support-duration disclosure. Campaign: cloud as the robot. Watch: any MMWA / §5 follow-on.

**Confidence.** High on the staff counts and the “may violate” language. Low on application to any named kinematic SKU.

---

## Forward indicators

1. Any no-refund companion brick that can be read against the 26 November paper.
2. Official Safety Gate HTML for A12/03112/24.
3. Ecovacs uptake, and whether leftover tokens / camera-on indicators appear in a later advisory.
4. GD-24-010283 — still no judgment found.
5. iRobot Q3 (6 November) cash as a support-capacity constraint — seen, not graduated.

> **Collection integrity.** Three signals. Five-signal form is not padded. Ecovacs HTML for both DSAs was opened; this filing states impact only and does not reproduce BLE, token, or camera-access procedures. Official Safety Gate HTML for A12/03112/24 was **not** loaded; the 8 November cite is B2. **Seen and held:** iRobot Q3 release, 6 November 2024 (earnings; not a harm primary this month). No CPSC or Health Canada consumer-robot recall dated November 2024 was located. Forum color: none opened.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C3</span></p>