CVE-2026-66403 describes a vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where the web server intended for debugging remains enabled. This exposure allows an attacker to remotely access sensitive data such as floor maps and logs stored on the affected devices. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality. No integrity or availability impact is noted. The vendor has not published any remediation or patch information, and the devices are not cloud services, so remediation depends on vendor updates or user action.

An unauthenticated remote attacker can access sensitive information including floor maps and logs from the affected DEEBOT PRO M1 and K1VAC devices. This compromises confidentiality but does not affect integrity or availability. The exposure of floor plans and logs could lead to privacy concerns or further targeted attacks based on the gathered information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the debug web server if possible or restrict network access to the device to trusted networks only.