CVE-2026-66409

MediumCVSS 5.3/10Last modified Aug 28, 2026

Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1391

Affected software

VendorProductVersions
ECOVACS ROBOTICSDEEBOT PRO M1< M1-1.7.27
ECOVACS ROBOTICSDEEBOT PRO K1VAC< V1.7.821

References

Timeline

Published
Aug 10, 2026
Last modified
Aug 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-66416.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions upCVE-2026-664104.8Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.CVE-2026-664115.3DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker CVE-2026-664126.5Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projectsCVE-2026-664146.1Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticatCVE-2026-664158.5Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read intCVE-2026-664168.8Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions oCVE-2026-664189.3OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrCVE-2026-66426.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechaniCVE-2026-664208.8MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers toCVE-2026-664219.3OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JaCVE-2026-664228.1Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within t
CVE-2026-66409: Medium severity, CVSS 5.3 | Vulnix