DEEBOT PRO CVE-2026-66404

Q: What is the CVSS score of CVE-2026-66404?

CVE-2026-66404 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-55111 MEDIUM

Improper Certificate Validation (CWE-295)

2026-08-10 jpcert

GHSA-fpq4-v8rh-q68m

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

6.0

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable MitM attack with no auth required, but AC:H for required positioning; C:H for log data; I:L for traffic manipulation; A:N as device function is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 09:22 NVD

6.5 (MEDIUM) 6.0 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 09:11 vuln.today

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

AnalysisAI

Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.

Technical ContextAI

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe protocol widely used in IoT devices for cloud connectivity. CWE-295 (Improper Certificate Validation) means the affected firmware does not perform proper TLS/SSL certificate chain verification during MQTT broker connections - specifically failing to authenticate the server identity. The affected products, cpe:2.3:a:ecovacs_robotics:deebot_pro_m1 and cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac (all versions per CPE wildcards), use MQTT to relay device telemetry and operational data to cloud infrastructure. Without certificate pinning or proper CA validation, any party able to intercept the network path can present a self-signed or attacker-controlled certificate and the device will proceed with the connection, exposing plaintext or decrypted MQTT payloads containing operation and activity log data.

RemediationAI

The primary remediation is to apply the firmware update referenced in the vendor advisory at https://robot.hellohas.co.jp/news/update_20260331/ (published 2026-03-31), which is expected to introduce proper server certificate validation in MQTT communications. An exact patched firmware version number was not independently confirmed from the available input data, so users should consult the advisory directly for the specific version to target. As a compensating control where firmware updates cannot be applied immediately, isolating affected devices on a dedicated IoT VLAN with egress traffic filtered to the legitimate Ecovacs cloud MQTT broker endpoints reduces the window for MitM interception, though this does not fix the underlying validation flaw. Blocking devices from connecting to untrusted Wi-Fi networks and ensuring home routers use WPA3 or WPA2 with strong credentials reduces the probability of local network compromise as a precursor step. The JPCERT advisory at https://jvn.jp/en/vu/JVNVU92804348/ may provide additional mitigation guidance.