CVE-2026-66406

MediumCVSS 4.8/10Last modified Aug 28, 2026

Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
ECOVACS ROBOTICS	DEEBOT PRO M1	< M1-1.7.27
ECOVACS ROBOTICS	DEEBOT PRO K1VAC	< V1.7.821

References

Timeline

Published: Aug 10, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-664078.1DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retriev CVE-2026-664084.6The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allo CVE-2026-664095.3DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and ob CVE-2026-66416.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up CVE-2026-664104.8Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.CVE-2026-664115.3DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker CVE-2026-664126.5Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects CVE-2026-664146.1Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticat CVE-2026-664158.5Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read int CVE-2026-664168.8Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions o CVE-2026-664189.3OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitr CVE-2026-66426.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechani