CVE-2026-66404: Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
AI Analysis
Technical Summary
CVE-2026-66404 describes an improper certificate validation vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC devices. These devices fail to properly validate server certificates in their MQTT communication channels, potentially allowing unauthorized access to operation and activity logs stored on the devices. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). No remediation level or patch information is currently available, and no known exploits have been reported.
Potential Impact
An attacker who can intercept or manipulate MQTT communications may retrieve sensitive operation and activity logs from the affected devices. This could lead to exposure of user activity data and device usage information. The vulnerability does not appear to allow modification or denial of service but impacts confidentiality with high impact and integrity with low impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting network exposure of the affected devices and monitor for updates from ECOVACS ROBOTICS.
CVE-2026-66404: Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1
Description
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-66404 describes an improper certificate validation vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC devices. These devices fail to properly validate server certificates in their MQTT communication channels, potentially allowing unauthorized access to operation and activity logs stored on the devices. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). No remediation level or patch information is currently available, and no known exploits have been reported.
Potential Impact
An attacker who can intercept or manipulate MQTT communications may retrieve sensitive operation and activity logs from the affected devices. This could lead to exposure of user activity data and device usage information. The vulnerability does not appear to allow modification or denial of service but impacts confidentiality with high impact and integrity with low impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting network exposure of the affected devices and monitor for updates from ECOVACS ROBOTICS.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jpcert
- Date Reserved
- 2026-07-27T00:45:20.456Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a798b4cbf8831d53957fe0e
Added to database: 08/10/2026, 08:26:52 UTC
Last enriched: 08/10/2026, 08:42:51 UTC
Last updated: 08/11/2026, 00:41:14 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.