CVE-2026-66404 identifies a vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where server certificates are not validated in MQTT communication channels. This flaw could enable unauthorized access to operation and activity logs stored on the devices. The vulnerability is rated with a CVSS 3.1 base score of 6.5, reflecting medium severity. There is no vendor advisory or patch information available to confirm remediation status.

An attacker could exploit the lack of certificate validation in MQTT communications to retrieve sensitive operation and activity logs from the affected DEEBOT devices. This could lead to unauthorized disclosure of potentially sensitive information stored on the products. There is no indication of impact on device integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about network environments where these devices operate and consider limiting exposure to untrusted networks.