Log in Start free

ECOVACS ROBOTICS

Products

ProductCVEsExploitedLatest
DEEBOT PRO K1VAC8–Aug 10, 2026
DEEBOT PRO M18–Aug 10, 2026
Android App "ECOVACS PRO"1–Aug 10, 2026
iOS App "ECOVACS PRO"1–Aug 10, 2026

Exploited and recent CVEs

  • CVE-2026-66411 Medium 5.3 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot. 0.4%
  • CVE-2026-66411 Medium 5.3 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot. 0.4%
  • CVE-2026-66410 Medium 4.8 Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered. 0.2%
  • CVE-2026-66410 Medium 4.8 Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered. 0.2%
  • CVE-2026-66409 Medium 5.3 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot. 0.3%
  • CVE-2026-66409 Medium 5.3 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot. 0.3%
  • CVE-2026-66408 Medium 4.6 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account. 0.2%
  • CVE-2026-66408 Medium 4.6 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account. 0.2%
  • CVE-2026-66407 High 8.1 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middl 0.3%
  • CVE-2026-66407 High 8.1 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middl 0.3%
  • CVE-2026-66406 Medium 4.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. A 0.2%
  • CVE-2026-66406 Medium 4.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. A 0.2%
  • CVE-2026-66405 High 8.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. 0.5%
  • CVE-2026-66405 High 8.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. 0.5%
  • CVE-2026-66404 Medium 6.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved. 0.2%
  • CVE-2026-66404 Medium 6.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved. 0.2%
  • CVE-2026-66403 High 7.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved. 0.4%
  • CVE-2026-66403 High 7.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved. 0.4%