Read the docs
TI-2026-47162 Aliases CVE-2026-66403GHSA-w22m-rfhf-hgj7

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled.

Priority MEDIUM 44CWE-489Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed DEEBOT PRO M1 (ECOVACS ROBOTICS): M1-1.7.27DEEBOT PRO K1VAC (ECOVACS ROBOTICS): V1.7.821

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ECOVACS ROBOTICSDEEBOT PRO M1before M1-1.7.27M1-1.7.27Patch availableCNA
ECOVACS ROBOTICSDEEBOT PRO K1VACbefore V1.7.821V1.7.821Patch availableCNA
  • DEEBOT PRO M1 VendorECOVACS ROBOTICS Affected before M1-1.7.27 Fixed in M1-1.7.27 Patch available CNA
  • DEEBOT PRO K1VAC VendorECOVACS ROBOTICS Affected before V1.7.821 Fixed in V1.7.821 Patch available CNA

Remediation

  • Fix · CNA DEEBOT PRO M1 (ECOVACS ROBOTICS) Fixed in M1-1.7.27
  • Fix · CNA DEEBOT PRO K1VAC (ECOVACS ROBOTICS) Fixed in V1.7.821

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ECOVACS ROBOTICS DEEBOT PRO K1VAC, DEEBOT PRO M1 M1-1.7.27, V1.7.821

    8 records Highest priority Priority MEDIUM 2 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2026-47164 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.Priority MEDIUM 40
    • TI-2026-47170 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in…Priority LOW 37
    • TI-2026-47168 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi…Priority LOW 36
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66403
  2. 2026-10-03 Alias added: GHSA-w22m-rfhf-hgj7

References

Other 2

  • TI-2026-47164 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. CVSS 4.0HIGH 8.7
  • TI-2026-47170 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CVSS 4.0MEDIUM 6.9
  • TI-2026-47168 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi… CVSS 4.0MEDIUM 6.9
  • TI-2026-47166 Broken or risky cryptographic algorithm in ECOVACS ROBOTICS DEEBOT PRO M1 CVSS 4.0HIGH 7.7
  • TI-2026-47163 Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1 CVSS 4.0MEDIUM 6.0
  • TI-2026-47167 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak… CVSS 4.0MEDIUM 5.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences