CVE-2026-66409 identifies a vulnerability in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where weak default passwords are used for their Wi-Fi hotspot networks. An attacker can analyze and obtain these passwords to connect to the affected robot's access point. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official remediation or patch information is provided, and no known exploits are reported in the wild.

An attacker can gain unauthorized access to the robot's Wi-Fi hotspot network by exploiting weak default passwords. This may allow network-level access to the device but does not directly compromise data integrity or availability. Confidentiality impact is limited as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided, users should consider changing default Wi-Fi hotspot passwords if possible or disabling the hotspot feature to reduce exposure.