DEEBOT PRO CVE-2026-66406

Q: What is the CVSS score of CVE-2026-66406?

CVE-2026-66406 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-55113 LOW

Improper Certificate Validation (CWE-295)

2026-08-10 jpcert

GHSA-j597-vwrg-g7qg

RCE Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

2.3

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

2.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

MITM positioning justifies AC:H and PR:N; stated RCE with admin privilege warrants C:H/I:H/A:H, overriding the vendor's C:L/I:L rating.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Aug 10, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Aug 10, 2026 - 09:22 NVD

4.8 (MEDIUM) 2.3 (LOW)

Analysis Generated

Aug 10, 2026 - 09:12 vuln.today

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

AnalysisAI

Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to man-in-the-middle interception and manipulation of all outbound wget communications. Because certificate verification is disabled, a network-positioned attacker can impersonate any remote server the device contacts, injecting malicious content the device will accept and act upon. Per the vendor description, successful exploitation may result in arbitrary code execution with administrative privileges on the device; no public exploit has been identified at time of analysis.

Technical ContextAI

The affected products - Ecovacs Robotics DEEBOT PRO M1 (CPE: cpe:2.3:a:ecovacs_robotics:deebot_pro_m1) and DEEBOT PRO K1VAC (CPE: cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac) - use the wget utility to retrieve content from remote servers with TLS certificate validation explicitly disabled (equivalent to the --no-check-certificate flag). This is classified under CWE-295 (Improper Certificate Validation), a root-cause class where software accepts a server's TLS certificate without verifying its authenticity or chain of trust. In IoT devices like robot vacuums, wget is typically invoked for firmware updates or cloud API polling; stripping certificate verification means the device cannot distinguish a legitimate Ecovacs server from an attacker-controlled host. Any party capable of intercepting or redirecting the device's network traffic can serve arbitrary responses that the device will process with full trust.

RemediationAI

Apply the firmware update detailed in the Ecovacs vendor advisory published on or around March 31, 2026, available at https://robot.hellohas.co.jp/news/update_20260331/. The JPCERT/CC coordination advisory at https://jvn.jp/en/vu/JVNVU92804348/ provides supplementary remediation context. An exact patched firmware version number was not independently confirmed from the available references - verify the specific version from the vendor page before deploying. Until a firmware update is applied, network-level compensating controls include: isolating affected devices to a dedicated IoT VLAN that restricts lateral access and limits MITM positioning opportunities (trade-off: may impair cloud-dependent features such as remote scheduling and app control); configuring Wi-Fi infrastructure to use Protected Management Frames (802.11w) and WPA3 where supported to raise the cost of ARP-spoofing attacks; and monitoring device traffic for unexpected destination IPs or certificate anomalies using network inspection tools. Avoid deploying these devices on untrusted or shared Wi-Fi segments.