DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.<ul><li>web server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403</li><li>Missing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404</li><li>telnet server remains enabled (CWE-489) - CVE-2026-66405</li><li>Missing server certificate verification in wget command (CWE-295) - CVE-2026-66406</li><ul><li>A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.</li></ul><li>Use of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407</li><ul><li>A man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.</li></ul><li>Weak password for root account (CWE-1391) - CVE-2026-66408</li><li>Weak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409</li><li>Improper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410</li><li>Dependency on vulnerable third-party component (CWE-1395)</li><ul><li>Known vulnerability in Quectel EG25-G device (CVE-2021-31698)</li></ul><li>Incorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411</li></ul>Hellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOT…