Ecovacs DEEBOT PRO CVE-2026-66403

The debug web server must be reachable by the attacker over a network path - typically requiring LAN access to the victim's home Wi-Fi, or internet reachability if the device is exposed via UPnP or manual port forwarding. No device-side authentication is required (PR:N per CVSS 4.0 vector). No special device configuration is needed - the debug web server is enabled by default as shipped (CWE-489 confirms this is a production-enabled debug artifact, not a user-activated feature). The specific TCP port(s) used by the debug web server are not disclosed in available data, which slightly raises the bar for exploitation but does not constitute a meaningful security control. Exploitation is bounded to information disclosure: the attacker cannot modify device settings, issue cleaning commands, or execute code via this vulnerability. Floor map and log retrieval is the full scope of impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately characterizes the exposure: network-reachable, zero authentication, no complexity or user interaction prerequisites, with high confidentiality impact on the device itself. Real-world risk is shaped by network topology - in the typical deployment the device sits on a home Wi-Fi LAN, requiring the attacker to already have LAN access (via a compromised device on the same network, rogue AP, or physical proximity). However, if the device is inadvertently exposed to the internet through UPnP or port forwarding (not uncommon in consumer IoT), exploitation becomes trivially remote. Impact is strictly information disclosure (VI:N/VA:N): no code execution, no device takeover. The privacy stakes are nonetheless meaningful - floor maps of a home constitute sensitive personal data. No EPSS data was provided. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, suggesting exploitation has not yet been observed at scale. This is a real privacy risk in specific network conditions, not a high-severity systemic threat.

An attacker who has gained access to the same Wi-Fi network as the robot vacuum - through a compromised IoT device, guest network misconfiguration, or physical proximity - discovers the DEEBOT PRO's IP address via network scanning. By sending unauthenticated HTTP GET requests to the debug web server's endpoints, the attacker retrieves a detailed floor map of the victim's home and operational logs revealing cleaning schedules, room usage patterns, and device identifiers. No public proof-of-concept has been identified, but the attack requires only basic HTTP tooling given the absence of any authentication mechanism.