Which versions of DEEBOT PRO M1 are affected by CVE-2026-66407?

Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums contain a WebSocket authentication vulnerability (CVE-2026-66407, CVSS 7.7) that exposes private key material through network…

How to fix or mitigate CVE-2026-66407?

Within 24 hours, inventory all DEEBOT PRO M1 and K1VAC devices currently deployed in your network environment. Within 7 days, verify firmware versions via device management interface and obtain the patched firmware released March 31, 2026 from Ecovacs support or the hellohas.co.jp advisory reference. Within 30 days, deploy the firmware update to all affected units, prioritizing internet-facing and sensitive network segments first.

DEEBOT PRO M1 CVE-2026-66407

Q: What is the CVSS score of CVE-2026-66407?

CVE-2026-66407 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55114 HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-08-10 jpcert

GHSA-85wr-c4p3-gmh4

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

7.7

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

MITM prerequisite raises AC to H; no privileges required; user must actively use the device; no described availability impact warrants A:N.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 09:22 NVD

8.1 (HIGH) 7.7 (HIGH)

Analysis Generated

Aug 10, 2026 - 09:04 vuln.today

CVE Published

Aug 10, 2026 - 08:00 cve.org

HIGH 8.1

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

AnalysisAI

WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.

Technical ContextAI

The vulnerability stems from CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) applied to the WebSocket communication stack of these Ecovacs Robotics consumer robot vacuums. WebSocket connections between the device and its controlling app or cloud backend are authenticated using a private key whose derivation or transmission is insufficiently protected, allowing an observer with a man-in-the-middle network position to recover the key from captured traffic. Once retrieved, that key can be used to decrypt session content or forge commands sent to the device. The CPE strings cpe:2.3:a:ecovacs_robotics:deebot_pro_m1:*:*:*:*:*:*:*:* and cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac:*:*:*:*:*:*:*:* show all versions of both models are affected, with no version-floor exclusion. The vulnerability sits in the application-layer authentication protocol, not in the underlying TLS transport per se, suggesting the key is either derived from observable parameters, transmitted insecurely, or stored in a way that survives traffic capture.

RemediationAI

Apply the vendor firmware update referenced in the March 31, 2026 update notice at https://robot.hellohas.co.jp/news/update_20260331/. Users should check their DEEBOT PRO M1 or K1VAC device for available firmware updates through the Ecovacs mobile app or the device's update mechanism and install the latest version. The JVN advisory at https://jvn.jp/en/vu/JVNVU92804348/ should be monitored for confirmed fixed firmware version numbers, which were not explicitly stated in the available references. As a compensating control while patching, isolate affected devices on a dedicated IoT VLAN or network segment to limit the attacker's ability to reach a MITM position; this does not eliminate the underlying cryptographic flaw but removes the network adjacency prerequisite. Disabling WebSocket-dependent features or remote control functionality would also eliminate the attack surface but would impair the device's primary control interface.