Which versions of DEEBOT PRO are affected by EUVD-2026-55112?

Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums ship with telnet service enabled and network-accessible, allowing authenticated users with device credentials to gain remote shell access…

How to fix or mitigate EUVD-2026-55112?

Within 24 hours, identify and document all DEEBOT PRO M1 and K1VAC devices in your environment and apply network-level access controls-restrict connectivity to these devices to only authorized management systems using firewall rules or network segmentation. Within 7 days, review the device firmware settings to determine if telnet can be disabled; if available, disable it immediately; if not, place the device on an isolated network segment with no access from untrusted networks, and monitor Ecovacs security advisories for patch releases. Within 30 days, if Ecovacs has not released a patch, evaluate the cost and risk of device replacement or retirement; additionally, implement a pre-deployment security review process for all IoT and network-connected devices to identify and remediate debug or test services before production release.

DEEBOT PRO EUVD-2026-55112

Q: What is the CVSS score of EUVD-2026-55112?

EUVD-2026-55112 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-66405 HIGH

Active Debug Code (CWE-489)

2026-08-10 jpcert

GHSA-r54q-x638-f78v

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

8.7

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Telnet is network-accessible with no complexity; PR:L reflects credential requirement per CVSS 4.0 input; unchanged scope as device compromise does not inherently extend to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 09:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 09:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Aug 10, 2026 - 09:04 vuln.today

CVE Published

Aug 10, 2026 - 07:59 cve.org

HIGH 8.8

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

AnalysisAI

Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.

Technical ContextAI

CWE-489 (Active Debug Code) describes a class of vulnerabilities where development or diagnostic interfaces are inadvertently retained in production firmware or software releases. In this case, a telnet daemon - an unencrypted, cleartext remote shell protocol dating to the 1960s - remains enabled by default on Ecovacs Robotics DEEBOT PRO M1 (CPE: cpe:2.3:a:ecovacs_robotics:deebot_pro_m1:*:*:*:*:*:*:*:*) and DEEBOT PRO K1VAC (CPE: cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac:*:*:*:*:*:*:*:*) robot vacuum firmware. Telnet provides direct command-line access to the underlying OS without encryption, meaning credentials and session data traverse the network in plaintext. This is a well-documented IoT firmware hygiene failure - debug shells intended for factory or development use are frequently left enabled in consumer devices and represent a privileged entry point if credentials are weak, default, or shared across units.

RemediationAI

Apply the firmware update referenced in the Ecovacs vendor advisory at https://robot.hellohas.co.jp/news/update_20260331/ (dated 2026-03-31), which addresses the enabled telnet service; the exact remediated firmware version is not confirmed from available data. If immediate patching is not possible, place the affected robot vacuums on a dedicated IoT VLAN or isolated network segment with no lateral routing to sensitive internal systems - this limits exploitation impact to the device itself, though it does not disable the telnet service. Additionally, configure firewall rules on the home router or network perimeter to block inbound and outbound TCP port 23 traffic to and from the device's IP, preventing remote telnet connectivity; note that this control does not remove the debug interface from firmware and may not protect against adjacent-network attackers. Neither network control is a substitute for the firmware patch, as the underlying debug service remains present until the firmware is updated.