Security Flaw in DEEBOT PRO Devices by Ecovacs

CVE-2026-66406

What is CVE-2026-66406?

The DEEBOT PRO M1 and DEEBOT PRO K1VAC devices from Ecovacs utilize the wget command without validating server certificates. This misconfiguration presents a significant security risk, as it allows for potential man-in-the-middle attacks. An attacker could intercept and modify communications between the device and server, enabling the execution of arbitrary code with administrative privileges, thereby compromising the integrity and security of the affected devices.

References