Server Certificate Validation Flaw in DEEBOT PRO Series by Ecovacs

CVE-2026-66404

What is CVE-2026-66404?

The DEEBOT PRO M1 and K1VAC models by Ecovacs have a significant server certificate validation issue in their MQTT communication protocol. This vulnerability exposes operation and activity logs, allowing unauthorized access to potentially sensitive information. Without proper validation of server certificates, these devices are susceptible to man-in-the-middle attacks, compromising security and privacy. Users of these devices are advised to take precautions and monitor their systems for any unusual activity.

References