CVE-2026-66404 — ECOVACS ROBOTICS / DEEBOT PRO M1

CVE-2026-66404

ECOVACS ROBOTICS / DEEBOT PRO M1 PUBLISHED

Description (CNA)

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

Affected (CNA)

Vendor / product	Versions
ECOVACS ROBOTICS / DEEBOT PRO M1	affected 0 before M1-1.7.27
ECOVACS ROBOTICS / DEEBOT PRO K1VAC	affected 0 before V1.7.821

CWE

CWE-295

References

https://robot.hellohas.co.jp/news/update_20260331/
https://jvn.jp/en/vu/JVNVU92804348/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.