Ecovacs DEEBOT PRO CVE-2026-66409

Q: What is the CVSS score of CVE-2026-66409?

CVE-2026-66409 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55116 MEDIUM

Use of Weak Credentials (CWE-1391)

2026-08-10 jpcert

GHSA-829w-c4jv-vqj4

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

6.9

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Exploitation requires Wi-Fi adjacency to the robot hotspot, making AV:A more accurate than NVD's AV:N; all other metrics are consistent with the description.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 09:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 09:12 vuln.today

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

AnalysisAI

Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate attacker to recover the access point password through analysis, then connect to the robot's local network interface. Reported by JPCERT/CC via JVN advisory JVNVU92804348, this affects all firmware versions of both models per CPE data. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low exploitation complexity combined with zero required privileges makes unauthorized Wi-Fi access straightforward for any attacker within radio range.

Technical ContextAI

CWE-1391 (Use of Weak Credentials) describes the root cause: the devices generate or use Wi-Fi hotspot passwords that are insufficiently random or follow a predictable derivation pattern - typically based on hardware identifiers such as MAC address or serial number fragments. Affected products are confirmed via CPE as cpe:2.3:a:ecovacs_robotics:deebot_pro_m1 and cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac (all versions, all platforms). Robot vacuums from Ecovacs typically broadcast a Wi-Fi hotspot during initial setup and, on some firmware configurations, persistently thereafter for local app control. The hotspot serves as the primary channel for the companion mobile application to issue cleaning commands and retrieve sensor data, meaning unauthorized hotspot access may expose that local command-and-control interface.

RemediationAI

Apply the firmware update referenced in the vendor notice at https://robot.hellohas.co.jp/news/update_20260331/ (released approximately 2026-03-31), which is expected to address the weak hotspot credential issue; the exact patched firmware version number is not independently confirmed from available data, so consult the vendor page directly to verify the target version. The JVN advisory at https://jvn.jp/en/vu/JVNVU92804348/ provides additional guidance. As an immediate compensating control prior to patching, disable the robot's Wi-Fi hotspot feature in the companion application settings when not actively pairing or performing setup; this eliminates the attack surface entirely at the cost of losing any local-network-only control capabilities. If hotspot must remain active, place the robot on an isolated IoT VLAN or guest network segment to limit lateral movement should the hotspot be compromised. Avoid operating the robot in environments with untrusted physical access (shared office spaces, lobbies) until patched.