EUVD-2026-55118
GHSA-p783-9mgr-fcxj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible WebSocket bypassed without credentials (AV:N, PR:N); impact limited to unauthorized robot operation (I:L); no confidentiality or availability impact confirmed by description.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.
AnalysisAI
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The robot must be reachable over the network - attack vector is network (AV:N) per the CVSS vector, requiring no physical or local access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) attack path with limited integrity impact (I:L) and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update referenced in the vendor advisory published March 31, 2026 at https://robot.hellohas.co.jp/news/update_20260331/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Deebot Pro M1
View allEnabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-access
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private ke
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-i
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expos
Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to ma
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today