EUVD-2026-55110
GHSA-w22m-rfhf-hgj7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Debug HTTP server is network-accessible with no authentication (PR:N, AV:N), impacts only confidentiality via floor map disclosure (C:H), with no integrity or availability impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
5DescriptionCVE.org
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.
AnalysisAI
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The debug web server must be reachable by the attacker over a network path - typically requiring LAN access to the victim's home Wi-Fi, or internet reachability if the device is exposed via UPnP or manual port forwarding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately characterizes the exposure: network-reachable, zero authentication, no complexity or user interaction prerequisites, with high confidentiality impact on the device itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update referenced in the vendor advisory published 2026-03-31 at https://robot.hellohas.co.jp/news/update_20260331/, which addresses the enabled debug web server. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Ecovacs DEEBOT PRO M1 and K1VAC devices deployed in enterprise and sensitive environments; immediately isolate them from general network access via air-gapping or placement on restricted network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Deebot Pro M1
View allEnabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-access
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private ke
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrect
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-i
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expos
Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to ma
Same weakness CWE-489 – Active Debug Code
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today