Ecovacs DEEBOT PRO CVE-2026-66409

The robot's Wi-Fi hotspot must be active - either during initial setup mode or during normal operation if the firmware keeps the hotspot persistently enabled for local app communication. The attacker must be within Wi-Fi radio range (typically 10-50 meters depending on environment). No authentication beyond the weak hotspot password is required (CVSS PR:N). Exploitation is limited to scenarios where the attacker has physical or near-physical proximity; internet-based remote exploitation is not possible. Impact is bounded to confidentiality of data accessible via the local robot interface (C:L); integrity and availability of the device are not affected per the CVSS vector.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) warrants scrutiny: the AV:N (Network) designation implies the attack is reachable over the internet, but exploitation actually requires physical Wi-Fi adjacency to the robot - suggesting AV:A (Adjacent Network) is more accurate. This vector discrepancy means the real-world attack surface is considerably narrower than a 5.3/Medium score implies. There is no EPSS data available for this CVE, no KEV listing, and no public proof-of-concept code at time of analysis. The CVSS impact is confined to C:L (limited confidentiality loss) with no integrity or availability impact. Practical risk is low-to-moderate: an attacker must be in close physical proximity, the reward is access to a consumer robot vacuum's local interface, and the disclosure is bounded to that device's local network segment. For enterprise environments, the risk is negligible; for privacy-conscious home users whose robot vacuums operate on shared or semi-public networks (e.g., apartments, offices), the risk is more meaningful.

An attacker within Wi-Fi range of the robot - for example, a neighbor in an adjacent apartment or a visitor in a home - scans for the DEEBOT hotspot SSID, captures the beacon or probes, and applies a known weak-credential derivation method (e.g., MAC-to-password mapping documented in similar IoT research) to recover the password without brute-force. The attacker then connects to the robot's access point and interacts with its local HTTP or application-layer interface. No public exploit code has been identified, but the low complexity of the attack means a moderately skilled attacker could replicate it independently.