CVE-2026-66410 describes a vulnerability in the ECOVACS PRO Android and iOS applications where server certificates are improperly validated. This flaw could enable an attacker to intercept or modify communications between the app and its servers. The CVSS 3.1 base score is 4.8, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No remediation level or patch information is provided, and no known exploits are reported in the wild.

The improper certificate validation may allow an attacker to perform man-in-the-middle attacks, potentially retrieving or altering data transmitted between the app and its backend servers. The impact affects confidentiality and integrity of communications but does not affect availability. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using the app on untrusted networks. Monitor vendor communications for updates.