Threats tagged 'ghsa-j597-vwrg-g7qg'

The ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC devices use the wget command with server certificate validation disabled. This improper certificate validation allows a man-in-the-middle (MitM) attacker to intercept and potentially alter communications. Such interception could lead to arbitrary code execution with administrative privileges on the affected devices. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch or remediation guidance is currently available.