CVE-2026-66405

HighCVSS 8.8/10Last modified Aug 28, 2026

Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-489

Affected software

VendorProductVersions
ECOVACS ROBOTICSDEEBOT PRO M1< M1-1.7.27
ECOVACS ROBOTICSDEEBOT PRO K1VAC< V1.7.821

References

Timeline

Published
Aug 10, 2026
Last modified
Aug 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664064.8DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obCVE-2026-664078.1DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrievCVE-2026-664084.6The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may alloCVE-2026-664095.3DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obCVE-2026-66416.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions upCVE-2026-664104.8Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.CVE-2026-664115.3DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker CVE-2026-664126.5Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projectsCVE-2026-664146.1Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticatCVE-2026-664158.5Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read intCVE-2026-664168.8Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions oCVE-2026-664189.3OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitr