DEEBOT PRO EUVD-2026-55118

Q: What is the CVSS score of EUVD-2026-55118?

EUVD-2026-55118 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-66411 MEDIUM

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-08-10 jpcert

GHSA-p783-9mgr-fcxj

Information Disclosure Deebot Pro M1 Deebot Pro K1Vac Ecovacs Robotics

6.9

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible WebSocket bypassed without credentials (AV:N, PR:N); impact limited to unauthorized robot operation (I:L); no confidentiality or availability impact confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 09:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 09:14 vuln.today

DescriptionCVE.org

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

AnalysisAI

Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability affects the WebSocket communication layer used by Ecovacs Robotics DEEBOT PRO M1 (cpe:2.3:a:ecovacs_robotics:deebot_pro_m1) and DEEBOT PRO K1VAC (cpe:2.3:a:ecovacs_robotics:deebot_pro_k1vac) robot vacuums, across all tracked versions per available CPE wildcard data. CWE-303 (Incorrect Implementation of Authentication Algorithm) indicates the authentication mechanism exists by design but contains a logic or cryptographic flaw in its execution - for example, a bypassable token validation, predictable nonce, or improperly enforced challenge-response - rather than a complete absence of authentication. WebSocket-based IoT control interfaces are a known attack surface in consumer robotics, as they typically handle real-time movement commands and sensor interactions over persistent connections.

RemediationAI

Apply the firmware update referenced in the vendor advisory published March 31, 2026 at https://robot.hellohas.co.jp/news/update_20260331/. An exact patched firmware version number is not independently confirmed from the available reference data - consult the advisory directly for version specifics. As a compensating control pending firmware update, place the robot on an isolated IoT VLAN or dedicated network segment inaccessible from untrusted hosts; this neutralizes the network-vector attack path without affecting device functionality. If network segmentation is not feasible, blocking or filtering access to the device's WebSocket port at the perimeter reduces external exposure. These controls limit reachability but do not remediate the underlying CWE-303 authentication flaw.