DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.<ul><li>web server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403</li><li>Missing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404</li><li>telnet server remains enabled (CWE-489) - CVE-2026-66405</li><li>Missing server certificate verification in wget command (CWE-295) - CVE-2026-66406</li><ul><li>A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.</li></ul><li>Use of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407</li><ul><li>A man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.</li></ul><li>Weak password for root account (CWE-1391) - CVE-2026-66408</li><li>Weak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409</li><li>Improper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410</li><li>Dependency on vulnerable third-party component (CWE-1395)</li><ul><li>Known vulnerability in Quectel EG25-G device (CVE-2021-31698)</li></ul><li>Incorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411</li></ul>Hellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOT…