Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-66404

MQTT Certificate Validation Failure Exposes Logs

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66403

Debugging Web Server Enabled Exposes Floor Maps and Logs

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66405

Telnet Service Enabled on Deebot Pro M1 and K1VAC

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66406

Disabled SSL Validation in DEEBOT Pro Enables MITM and Remote Code Execution

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66407

Improper WebSocket Authentication Enables Key Retrieval and Traffic Tampering on Deebot Pro M1 and K1VAC

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66408

Weak Root Passwords Enable Physical Access Compromise on DEEBOT Pro M1 and K1VAC

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66409

Weak Wi‑Fi Hotspot Passwords Enable Unauthenticated Access on Deebot Robots

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1
CVE-2026-66411

Unauthenticated WebSocket Control of Ecovacs Deebot Robots

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ecovacs Robotics
Products
Deebot Pro K1vac Deebot Pro M1