CVE-2026-66406
Received Received - Intake

DEEBOT PRO M1 and DEEBOT PRO K1VAC Command Injection

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: JPCERT/CC

Description
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-66406
EUVD
EUVD-2026-55113

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hellohas_robotics deebot_pro_m1 *
hellohas_robotics deebot_pro_k1vac *
ecovacs ecovacs_pro_app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves DEEBOT PRO M1 and DEEBOT PRO K1VAC cleaning robots using the wget command without proper server certificate validation. This allows a man-in-the-middle attack to intercept or alter communications between the device and other systems. As a result, an attacker could execute arbitrary code with administrative privileges.

Detection Guidance

To detect this vulnerability, check if your DEEBOT PRO M1 or DEEBOT PRO K1VAC devices are running outdated firmware without the March 31, 2026 update. Inspect network traffic for unencrypted or improperly validated WebSocket communications between the device and app. Monitor for Telnet access on default ports and verify if wget commands are executed without server certificate validation.

Impact Analysis

An attacker could intercept sensitive data transmitted by the device or alter its communications to execute malicious code with high privileges. This could lead to unauthorized access to your network, data theft, or control over the device itself.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using these devices may face compliance violations and potential legal consequences.

Mitigation Strategies

Apply the firmware update released on March 31, 2026, for DEEBOT PRO M1 and DEEBOT PRO K1VAC. Disable Telnet access, close vulnerable ports 8888 and 9999, and ensure WebSocket communications use proper certificate validation. Update the ECOVACS PRO App to the latest version and enforce stronger root passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart