Vulnerabilities

TI-2026-47170 CVE-2026-66411 · GHSA-p783-9mgr-fcxj

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in…

LOW 37

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0039 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-303

TI-2026-47169 CVE-2026-66410 · GHSA-945x-4wx3-jqmg

LOW 11

Android and iOS apps ECOVACS PRO App improperly validate server certificates.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00165 Published 2026-08-10 Fixed in 1.3.82 CWE-295

TI-2026-47168 CVE-2026-66409 · GHSA-829w-c4jv-vqj4

LOW 36

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-1391

TI-2026-47167 CVE-2026-66408 · GHSA-qcc9-63j4-p26h

LOW 25

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.

CVSS 4.0MEDIUM 5.1 Physical No auth No interaction EPSS 0.00204 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-1391

TI-2026-47166 CVE-2026-66407 · GHSA-85wr-c4p3-gmh4

LOW 36

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00329 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-327

TI-2026-47165 CVE-2026-66406 · GHSA-j597-vwrg-g7qg

LOW 11

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00151 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-295

TI-2026-47164 CVE-2026-66405 · GHSA-r54q-x638-f78v

MEDIUM 40

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00508 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-489

TI-2026-47163 CVE-2026-66404 · GHSA-fpq4-v8rh-q68m

LOW 26

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00203 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-295

TI-2026-47162 CVE-2026-66403 · GHSA-w22m-rfhf-hgj7

MEDIUM 44

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-08-10 Fixed in M1-1.7.27, V1.7.821 CWE-489