61 matches found
CVE-2026-66408
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...
CVE-2026-66408
CVE-2026-66408 affects the DEEBOT PRO M1 and DEEBOT PRO K1VAC: the root accounts are configured with weak passwords. A user with physical access can obtain the root password, enabling privileged action on the device. The CVSS metrics indicate a physical attack with low complexity, but high confid...
EUVD-2026-55114
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...
CVE-2026-66407
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...
CVE-2026-66407
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...
CVE-2026-66407
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...
CVE-2026-66407
CVE-2026-66407 affects DEEBOT PRO M1 and PRO K1VAC, where authentication in WebSocket communications is improperly implemented. According to sources, the WebSocket private key may be retrieved via a man-in-the-middle analysis of traffic, allowing an attacker to analyze and potentially alter commu...
CVE-2026-66406
DEEBOT PRO M1 and DEEBOT PRO K1VAC are affected by CVE-2026-66406: wget is used with server certificate verification disabled, enabling a MITM to obtain/alter communications and potentially execute arbitrary code with administrative privileges. The issue is described as Missing server certificate...
CVE-2026-66406
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...
CVE-2026-66406
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...
EUVD-2026-55113
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...
CVE-2026-66405
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...
EUVD-2026-55112
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...
CVE-2026-66405
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...
CVE-2026-66405
The CVE-2026-66405 entry concerns DEEBOT PRO M1 and DEEBOT PRO K1VAC where telnet servers remain enabled (telnet service may be used to log in). Connected sources confirm multiple vulnerabilities in these models and related ECOVACS app; the telnet issue is explicitly called out (CVE-66405). Root ...
CVE-2026-66405
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...
CVE-2026-66404
The CVE-2026-66404 issue affects DEEBOT PRO M1 and DEEBOT PRO K1VAC where the MQTT client does not validate server certificates, enabling potential unauthorized access to operation and activity logs stored on the device. The vulnerability is categorized as missing server certificate verification ...
EUVD-2026-55111
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved...