DEEBOT PRO EUVD-2026-55112

The DEEBOT PRO M1 or K1VAC must be reachable on the network - either via the local LAN the device is connected to, or via the internet if TCP port 23 is inadvertently exposed through router port forwarding (the latter would be an additional misconfiguration). The CVSS PR:L metric confirms that valid telnet credentials are required; unauthenticated exploitation is not indicated by available data. The telnet service requires no user action to enable - it is active by default in the shipped firmware, which is the core of this CWE-489 flaw. Exploitation is bounded by: (1) network adjacency or reachability to the device, (2) possession of valid telnet credentials (default, hardcoded, or previously compromised), and (3) the target device being one of the two specifically named models. Exploitation is not conditional on any user-configured feature or non-default setting beyond the device being powered on and network-connected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting network-accessible exploitation requiring no attack complexity, no specific attack conditions, and yielding full compromise of device confidentiality, integrity, and availability. The PR:L metric indicates some level of credential is required, which is the primary limiting factor - however, IoT devices commonly ship with weak or hardcoded default credentials, which could substantially reduce the practical barrier in real-world attacks. No EPSS score was provided, and no CISA KEV listing exists, meaning widespread active exploitation has not been confirmed. No public exploit code has been identified at time of analysis. The restricted subsequent-system impact (SC:N/SI:N/SA:N) suggests the CVSS assessment does not account for lateral movement potential from a compromised network-connected device, which may understate risk in environments where the robot vacuum shares a flat network with sensitive systems. Overall, this is a genuine priority for organizations with affected devices on production networks, but the PR:L requirement and absence of a KEV listing temper urgency compared to fully unauthenticated IoT flaws.

An attacker with access to the same local network as an affected DEEBOT PRO device - such as a guest on a shared Wi-Fi, or a threat actor who has compromised another LAN-connected device - scans for open telnet ports and connects to the robot vacuum on TCP port 23. Using default or previously obtained credentials for the device's telnet service, the attacker authenticates and obtains a shell on the device firmware, enabling data access, potential surveillance (if the device has audio or camera hardware), configuration manipulation, or use of the device as a foothold for further lateral movement. No public exploit code has been identified at time of analysis; standard telnet clients suffice.