DEEBOT PRO CVE-2026-66408

Physical access to the device is the mandatory prerequisite - this is not remotely exploitable as described. The CVSS vector AV:P confirms the physical access requirement explicitly. Exploitation is limited to individuals who can physically handle the device, connect hardware tools to its debug or storage interfaces, and spend sufficient time to extract or brute-force the weak root credential. Authentication is effectively bypassed by the weakness itself (CWE-1391), but only after physical access is achieved. Exploitation is further limited to the specific model lines: DEEBOT PRO M1 and DEEBOT PRO K1VAC - other Ecovacs product lines are not named in this advisory. No network exposure, no remote code path, and no user interaction with the device owner are required or involved.

The CVSS vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 4.6 (Medium), reflecting that physical proximity is the mandatory prerequisite - a significant real-world limiting factor that substantially narrows the attacker population. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, suggesting it has not been observed in widespread exploitation. The physical attack vector means even a mid-sized municipal IT team in tczew deploying robotic cleaning units in public-facing facilities should focus remediation efforts on controlling physical access to devices rather than treating this as an emergency remote-exploitation priority. The official CVSS impact of C:H/I:N/A:N models only the credential disclosure step; however, obtaining root credentials in practice enables full device compromise including integrity and availability impacts, suggesting the scored impact may underrepresent the downstream blast radius once the password is in attacker hands. No SSVC data was provided, but given the physical-only attack vector and lack of KEV or POC, this is a low-priority finding for most operational environments outside those where devices are left physically unattended in untrusted areas.

An attacker with brief unsupervised physical access to a DEEBOT PRO M1 or K1VAC unit - for example, a visitor in a facility where the device charges unattended - connects to an exposed hardware debug interface such as a UART port, boots to a root shell or dumps credentials from flash storage, and recovers the weak root password. With root credentials in hand, the attacker can subsequently authenticate to any enabled network service on the device and maintain persistent access or pivot within the local network. No public proof-of-concept code is known at time of analysis.