Read the docs
TI-2026-47163 Aliases CVE-2026-66404GHSA-fpq4-v8rh-q68m

Improper certificate validation in ECOVACS ROBOTICS DEEBOT PRO M1

Priority LOW 26CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix Fixed DEEBOT PRO M1 (ECOVACS ROBOTICS): M1-1.7.27DEEBOT PRO K1VAC (ECOVACS ROBOTICS): V1.7.821

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ECOVACS ROBOTICSDEEBOT PRO M1before M1-1.7.27M1-1.7.27Patch availableCNA
ECOVACS ROBOTICSDEEBOT PRO K1VACbefore V1.7.821V1.7.821Patch availableCNA
  • DEEBOT PRO M1 VendorECOVACS ROBOTICS Affected before M1-1.7.27 Fixed in M1-1.7.27 Patch available CNA
  • DEEBOT PRO K1VAC VendorECOVACS ROBOTICS Affected before V1.7.821 Fixed in V1.7.821 Patch available CNA

Remediation

  • Fix · CNA DEEBOT PRO M1 (ECOVACS ROBOTICS) Fixed in M1-1.7.27
  • Fix · CNA DEEBOT PRO K1VAC (ECOVACS ROBOTICS) Fixed in V1.7.821

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ECOVACS ROBOTICS DEEBOT PRO K1VAC, DEEBOT PRO M1 M1-1.7.27, V1.7.821

    8 records Highest priority Priority MEDIUM 2 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2026-47162 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled.Priority MEDIUM 44
    • TI-2026-47164 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.Priority MEDIUM 40
    • TI-2026-47170 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in…Priority LOW 37
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66404
  2. 2026-10-03 Alias added: GHSA-fpq4-v8rh-q68m

References

Other 2

  • TI-2026-47162 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. CVSS 4.0HIGH 8.7
  • TI-2026-47164 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. CVSS 4.0HIGH 8.7
  • TI-2026-47170 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CVSS 4.0MEDIUM 6.9
  • TI-2026-47168 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi… CVSS 4.0MEDIUM 6.9
  • TI-2026-47166 Broken or risky cryptographic algorithm in ECOVACS ROBOTICS DEEBOT PRO M1 CVSS 4.0HIGH 7.7
  • TI-2026-47167 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak… CVSS 4.0MEDIUM 5.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences