CVE-2026-66406 describes a vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where the wget command is used without validating server certificates. This improper certificate validation exposes the devices to man-in-the-middle attacks, enabling attackers to intercept or modify communications. Exploitation could result in arbitrary code execution with administrative privileges. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.8. No vendor advisory or patch information is provided at this time.

An attacker capable of performing a man-in-the-middle attack can intercept or alter communications between the affected devices and servers. This could lead to execution of arbitrary code with administrative privileges on the device, potentially compromising device integrity and security. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should minimize exposure to untrusted networks and monitor vendor communications for updates.