Vulnerability-Lookup

CVE-2026-66409 (GCVE-0-2026-66409)

Vulnerability from cvelistv5 – Published: 2026-08-10 08:04 – Updated: 2026-08-10 18:05

Summary

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 18:01 UTC

CWE

CWE-1391 - Use of weak credentials

Assigner

jpcert jpcert root

References

2 references

URL	Tags
https://robot.hellohas.co.jp/news/update_20260331/
https://jvn.jp/en/vu/JVNVU92804348/

Impacted products

2 products

Vendor	Product	Version	CPE status
ECOVACS ROBOTICS	DEEBOT PRO M1	Affected: 0 , < M1-1.7.27 (semver)	guessed
ECOVACS ROBOTICS	DEEBOT PRO K1VAC	Affected: 0 , < V1.7.821 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T18:01:59.082529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T18:05:13.772Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DEEBOT PRO M1",
          "vendor": "ECOVACS ROBOTICS",
          "versions": [
            {
              "lessThan": "M1-1.7.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DEEBOT PRO K1VAC",
          "vendor": "ECOVACS ROBOTICS",
          "versions": [
            {
              "lessThan": "V1.7.821",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\r\nThe password may be analyzed and obtained to connect to the access point of an affected robot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "Use of weak credentials",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T08:04:05.423Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://robot.hellohas.co.jp/news/update_20260331/"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU92804348/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-66409",
    "datePublished": "2026-08-10T08:04:05.423Z",
    "dateReserved": "2026-07-27T00:45:20.457Z",
    "dateUpdated": "2026-08-10T18:05:13.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-66409",
      "date": "2026-09-26",
      "epss": "0.00325",
      "percentile": "0.23015"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "DEEBOT PRO M1",
                "vendor": "ECOVACS ROBOTICS",
                "versions": [
                  {
                    "lessThan": "M1-1.7.27",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "DEEBOT PRO K1VAC",
                "vendor": "ECOVACS ROBOTICS",
                "versions": [
                  {
                    "lessThan": "V1.7.821",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\r\nThe password may be analyzed and obtained to connect to the access point of an affected robot."
          }
        ],
        "id": "CVE-2026-66409",
        "lastModified": "2026-08-28T16:09:10.947",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "vultures@jpcert.or.jp",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "vultures@jpcert.or.jp",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-66409",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T18:01:59.082529Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-10T09:17:23.210",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://jvn.jp/en/vu/JVNVU92804348/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://robot.hellohas.co.jp/news/update_20260331/"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1391"
              }
            ],
            "source": "vultures@jpcert.or.jp",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-66409",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-10T18:01:59.082529Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-10T18:04:59.827Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "DEEBOT PRO M1",
              "vendor": "ECOVACS ROBOTICS",
              "versions": [
                {
                  "lessThan": "M1-1.7.27",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "DEEBOT PRO K1VAC",
              "vendor": "ECOVACS ROBOTICS",
              "versions": [
                {
                  "lessThan": "V1.7.821",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\r\nThe password may be analyzed and obtained to connect to the access point of an affected robot."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1391",
                  "description": "Use of weak credentials",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-10T08:04:05.423Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://robot.hellohas.co.jp/news/update_20260331/"
            },
            {
              "url": "https://jvn.jp/en/vu/JVNVU92804348/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2026-66409",
        "datePublished": "2026-08-10T08:04:05.423Z",
        "dateReserved": "2026-07-27T00:45:20.457Z",
        "dateUpdated": "2026-08-10T18:05:13.772Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-66409

Vulnerability from fkie_nvd - Published: 2026-08-10 09:17 - Updated: 2026-08-28 16:09

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU92804348/
	vultures@jpcert.or.jp	https://robot.hellohas.co.jp/news/update_20260331/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "DEEBOT PRO M1",
          "vendor": "ECOVACS ROBOTICS",
          "versions": [
            {
              "lessThan": "M1-1.7.27",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DEEBOT PRO K1VAC",
          "vendor": "ECOVACS ROBOTICS",
          "versions": [
            {
              "lessThan": "V1.7.821",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\r\nThe password may be analyzed and obtained to connect to the access point of an affected robot."
    }
  ],
  "id": "CVE-2026-66409",
  "lastModified": "2026-08-28T16:09:10.947",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-66409",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-10T18:01:59.082529Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-10T09:17:23.210",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/vu/JVNVU92804348/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://robot.hellohas.co.jp/news/update_20260331/"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1391"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

GHSA-829W-C4JV-VQJ4

Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-10 09:31

Details

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-66409"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1391"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T09:17:23Z",
    "severity": "MODERATE"
  },
  "details": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\nThe password may be analyzed and obtained to connect to the access point of an affected robot.",
  "id": "GHSA-829w-c4jv-vqj4",
  "modified": "2026-08-10T09:31:24Z",
  "published": "2026-08-10T09:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66409"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU92804348"
    },
    {
      "type": "WEB",
      "url": "https://robot.hellohas.co.jp/news/update_20260331"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

JVNDB-2026-026400

Vulnerability from jvndb - Published: 2026-08-04 05:10 - Updated:2026-08-05 03:28

Severity

7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Details

Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.

web server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403
Missing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404
telnet server remains enabled (CWE-489) - CVE-2026-66405
Missing server certificate verification in wget command (CWE-295) - CVE-2026-66406

A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.

Use of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407

A man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.

Weak password for root account (CWE-1391) - CVE-2026-66408
Weak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409
Improper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410
Dependency on vulnerable third-party component (CWE-1395)

Known vulnerability in Quectel EG25-G device (CVE-2021-31698)

Incorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411

Hellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOTICS, and reported to JPCERT/CC to notify users of the solutions through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU92804348/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2021-31698
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66403
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66404
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66405
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66406
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66407
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66408
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66409
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66410
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-66411
	Use of Weak Credentials(CWE-1391)	https://cwe.mitre.org/data/definitions/1391.html
	Dependency on Vulnerable Third-Party Component(CWE-1395)	https://cwe.mitre.org/data/definitions/1395.html
	Improper Certificate Validation(CWE-295)	https://cwe.mitre.org/data/definitions/295.html
	Incorrect Implementation of Authentication Algorithm(CWE-303)	https://cwe.mitre.org/data/definitions/303.html
	Use of a Broken or Risky Cryptographic Algorithm(CWE-327)	https://cwe.mitre.org/data/definitions/327.html
	Active Debug Code(CWE-489)	https://cwe.mitre.org/data/definitions/489.html

Impacted products

Vendor

Product

	ECOVACS	ECOVACS PRO
	Hellohas Robotics Inc.	DEEBOT PRO

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
  "dc:date": "2026-08-05T12:28+09:00",
  "dcterms:issued": "2026-08-04T14:10+09:00",
  "dcterms:modified": "2026-08-05T12:28+09:00",
  "description": "Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.\u003cul\u003e\u003cli\u003eweb server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403\u003c/li\u003e\u003cli\u003eMissing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404\u003c/li\u003e\u003cli\u003etelnet server remains enabled (CWE-489) - CVE-2026-66405\u003c/li\u003e\u003cli\u003eMissing server certificate verification in wget command (CWE-295) - CVE-2026-66406\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eUse of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eWeak password for root account (CWE-1391) - CVE-2026-66408\u003c/li\u003e\u003cli\u003eWeak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409\u003c/li\u003e\u003cli\u003eImproper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395)\u003c/li\u003e\u003cul\u003e\u003cli\u003eKnown vulnerability in Quectel EG25-G device (CVE-2021-31698)\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eIncorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411\u003c/li\u003e\u003c/ul\u003eHellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOTICS, and reported to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:ecovacs:ecovacs_pro",
      "@product": "ECOVACS PRO",
      "@vendor": "ECOVACS",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:misc:hellohas_robotics_deebot_pro",
      "@product": "DEEBOT PRO",
      "@vendor": "Hellohas Robotics Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-026400",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92804348/index.html",
      "@id": "JVNVU#92804348",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2021-31698",
      "@id": "CVE-2021-31698",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66403",
      "@id": "CVE-2026-66403",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66404",
      "@id": "CVE-2026-66404",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66405",
      "@id": "CVE-2026-66405",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66406",
      "@id": "CVE-2026-66406",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66407",
      "@id": "CVE-2026-66407",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66408",
      "@id": "CVE-2026-66408",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66409",
      "@id": "CVE-2026-66409",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66410",
      "@id": "CVE-2026-66410",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66411",
      "@id": "CVE-2026-66411",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1391.html",
      "@id": "CWE-1391",
      "@title": "Use of Weak Credentials(CWE-1391)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1395.html",
      "@id": "CWE-1395",
      "@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/295.html",
      "@id": "CWE-295",
      "@title": "Improper Certificate Validation(CWE-295)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/303.html",
      "@id": "CWE-303",
      "@title": "Incorrect Implementation of Authentication Algorithm(CWE-303)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/327.html",
      "@id": "CWE-327",
      "@title": "Use of a Broken or Risky Cryptographic Algorithm(CWE-327)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/489.html",
      "@id": "CWE-489",
      "@title": "Active Debug Code(CWE-489)"
    }
  ],
  "title": "Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-66409 (GCVE-0-2026-66409)

FKIE_CVE-2026-66409

GHSA-829W-C4JV-VQJ4

JVNDB-2026-026400

Tags

Sightings

Nomenclature

Related by attack behaviour