CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

Score

CVSS 3.1 8.1 High

Status

Deferred - vultures@jpcert.or.jp

Published

2026-08-10

Last modified

2026-08-10

Weaknesses

CWE-327

Affected products

• Deebot Pro K1vac (Ecovacs Robotics)
• Deebot Pro M1 (Ecovacs Robotics)

References

• https://jvn.jp/en/vu/JVNVU92804348/
• https://robot.hellohas.co.jp/news/update_20260331/