CVE-2026-66409 identifies a security weakness in the ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where the devices are configured with weak Wi-Fi hotspot passwords. An attacker can analyze and obtain these passwords, enabling unauthorized connection to the robot's access point. The vulnerability does not require privileges or user interaction and has a network attack vector. The impact is limited to confidentiality, with no integrity or availability impact reported. No official remediation or patch information is currently available.

An attacker who obtains the weak Wi-Fi hotspot password can connect to the affected robot's access point, potentially gaining unauthorized access to the device's network interface. The confidentiality of the device's network communications may be compromised. There is no reported impact on integrity or availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Wi-Fi hotspot if possible or placing the device in a secure network environment to reduce exposure. Avoid connecting to unknown or untrusted networks through the device's hotspot.