DEEBOT PRO CVE-2026-66408

Q: What is the CVSS score of CVE-2026-66408?

CVE-2026-66408 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-55115 MEDIUM

Use of Weak Credentials (CWE-1391)

2026-08-10 jpcert

GHSA-qcc9-63j4-p26h

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

5.1

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Physical access is required (AV:P); obtaining root credentials effectively grants full device control, justifying C:H/I:H/A:H rather than the advisory's C:H/I:N/A:N.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 09:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 09:12 vuln.today

DescriptionCVE.org

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

AnalysisAI

Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.

Technical ContextAI

The DEEBOT PRO M1 and DEEBOT PRO K1VAC are consumer IoT robotic vacuum cleaners manufactured by Ecovacs Robotics, running embedded Linux with a root account. The vulnerability is classified as CWE-1391 (Use of Weak Credentials), indicating that the manufacturer shipped these devices with insufficiently strong passwords on the privileged root account. CPE identifiers cpe:2.3:a:ecovacs_robotics:deebot_pro_m1 and cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac cover all versions of both product lines. The root account weak password can be extracted or brute-forced by a party with physical access to the device, likely through direct hardware interface such as a UART or debug port, or via credential extraction from onboard storage.

RemediationAI

The primary remediation is to apply any firmware update released by Ecovacs Robotics as referenced in the vendor advisory at https://robot.hellohas.co.jp/news/update_20260331/. No exact patched firmware version number is independently confirmed from the available data; consult that advisory for the specific release. As a compensating control where firmware update is not immediately possible, restrict physical access to the devices - ensure they are not left unattended in areas accessible to untrusted individuals, and store them in secured locations when not in active use. If the device exposes any network services using the root account credentials, consider network segmentation to prevent lateral exploitation of any recovered passwords. Changing the root password via the device's own administrative interface, if exposed, is advisable as an additional layer of defense, though the mechanism for doing so on these devices is not specified in the available references.