CVE-2026-66406 describes a vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where the wget command is used without proper server certificate validation. This misconfiguration enables a man-in-the-middle attacker to intercept and modify communications between the device and its servers. Exploitation of this flaw may result in arbitrary code execution with administrative privileges on the device. The CVSS 3.1 base score is 4.8, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and low impact on confidentiality and integrity, with no availability impact. There is no vendor advisory or patch information available to confirm remediation status.

An attacker capable of performing a man-in-the-middle attack could intercept and alter communications to the affected DEEBOT devices. This could lead to execution of arbitrary code with administrative privileges, potentially compromising device integrity and control. The impact is rated medium based on the CVSS score of 4.8, indicating limited confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should minimize exposure to untrusted networks and consider network-level protections to prevent man-in-the-middle attacks. No vendor-provided mitigation or temporary fix is currently documented.