CVE-2026-66403
Received Received - Intake

Debug Web Server Exposes Data in DEEBOT PRO M1 and DEEBOT PRO K1VAC

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: JPCERT/CC

Description
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-66403
EUVD
EUVD-2026-55110

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ecovacs deebot_pro_m1 *
ecovacs deebot_pro_k1vac *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-489 The product is released with debugging code still enabled or active.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

DEEBOT PRO M1 and DEEBOT PRO K1VAC devices have a debugging web server enabled that allows retrieval of stored floor maps and log information without authentication.

Detection Guidance

Check if the web server for debugging is enabled on DEEBOT PRO M1 or DEEBOT PRO K1VAC devices. Use network scanning tools like nmap to identify open ports on the devices. For example, run: nmap -p- <device_IP> to scan all ports. If port 80 or 443 is open without proper authentication, it may indicate the vulnerability.

Impact Analysis

Attackers could access sensitive data like floor plans or device logs, potentially revealing occupancy patterns or system operations. This may lead to privacy breaches or physical security risks.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR or HIPAA if personal or sensitive data is exposed. Organizations may face compliance penalties due to unauthorized data access.

Mitigation Strategies

Disable the web server for debugging on affected DEEBOT devices if possible. Ensure the devices are not exposed to untrusted networks. Update the firmware to the latest version if an official patch is available. Restrict network access to the devices using firewalls or VLANs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart