ECOVACS ROBOTICS vulnerabilities

Newest CVEs

• CVE-2026-66411

  DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  Medium6.9
• CVE-2026-66410

  Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.

  ECOVACS ROBOTICS · Android App "ECOVACS PRO"

  Low2.3
• CVE-2026-66409

  DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  Medium6.9
• CVE-2026-66408

  The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  Medium5.1
• CVE-2026-66407

  DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  High7.7
• CVE-2026-66406

  DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  Low2.3
• CVE-2026-66405

  DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

  ECOVACS ROBOTICS · DEEBOT PRO M1

  High8.7
• CVE-2026-66404

  DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  Medium6.0
• CVE-2026-66403

  DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may…

  ECOVACS ROBOTICS · DEEBOT PRO M1

  High8.7