Ecovacs Robotics Deebot Pro K1vac
8 CVEs affecting Ecovacs Robotics Deebot Pro K1vac. Latest disclosed: 2026-08-10. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66405 | High | 8.8 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. |
CVE-2026-66407 | High | 8.1 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzin… |
CVE-2026-66403 | High | 7.5 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may b… |
CVE-2026-66404 | Medium | 6.5 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products… |
CVE-2026-66411 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and ope… |
CVE-2026-66409 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect t… |
CVE-2026-66406 | Medium | 4.8 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter c… |
CVE-2026-66408 | Medium | 4.6 | 2026-08-10 | The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the pas… |