CVE-2026-66407 describes a vulnerability in the ECOVACS ROBOTICS DEEBOT PRO M1 and PRO K1VAC where the authentication mechanism for WebSocket communication is improperly implemented. This improper implementation allows an attacker to retrieve the WebSocket private key by intercepting and analyzing traffic data via a man-in-the-middle attack. With access to the private key, the attacker can alter the contents of the communication between the device and its controller or server.

An attacker capable of performing a man-in-the-middle attack can obtain the WebSocket private key, compromising the confidentiality and integrity of the communication. This can lead to unauthorized control or manipulation of the device's communication, potentially impacting device operation and user privacy. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users and administrators should monitor vendor communications for updates and apply patches once available.