Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-66411 EUVD-2026-55118GHSA-p783-9mgr-fcxj

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker …

Published Aug 10, 2026 · Updated Aug 10, 2026 · Assigned by jpcert

Vendor: ECOVACS ROBOTICS Product: DEEBOT PRO K1VAC Product: DEEBOT PRO M1

Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.
An unauthenticated attacker may connect and operate the affected robot.

Affected products

VendorProductAffectedFixed
ECOVACS ROBOTICS DEEBOT PRO M1 < M1-1.7.27 M1-1.7.27
ECOVACS ROBOTICS DEEBOT PRO K1VAC < V1.7.821 V1.7.821

References