Action not permitted
Modal body text goes here.
Modal Title
Modal Body
JVNDB-2026-026400
Vulnerability from jvndb - Published: 2026-08-04 05:10 - Updated:2026-08-05 03:28
Severity
Summary
Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App
Details
Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.
- web server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403
- Missing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404
- telnet server remains enabled (CWE-489) - CVE-2026-66405
- Missing server certificate verification in wget command (CWE-295) - CVE-2026-66406
- A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.
- Use of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407
- A man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.
- Weak password for root account (CWE-1391) - CVE-2026-66408
- Weak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409
- Improper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410
- Dependency on vulnerable third-party component (CWE-1395)
- Known vulnerability in Quectel EG25-G device (CVE-2021-31698)
- Incorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
"dc:date": "2026-08-05T12:28+09:00",
"dcterms:issued": "2026-08-04T14:10+09:00",
"dcterms:modified": "2026-08-05T12:28+09:00",
"description": "Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.\u003cul\u003e\u003cli\u003eweb server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403\u003c/li\u003e\u003cli\u003eMissing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404\u003c/li\u003e\u003cli\u003etelnet server remains enabled (CWE-489) - CVE-2026-66405\u003c/li\u003e\u003cli\u003eMissing server certificate verification in wget command (CWE-295) - CVE-2026-66406\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eUse of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eWeak password for root account (CWE-1391) - CVE-2026-66408\u003c/li\u003e\u003cli\u003eWeak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409\u003c/li\u003e\u003cli\u003eImproper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395)\u003c/li\u003e\u003cul\u003e\u003cli\u003eKnown vulnerability in Quectel EG25-G device (CVE-2021-31698)\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eIncorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411\u003c/li\u003e\u003c/ul\u003eHellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOTICS, and reported to JPCERT/CC to notify users of the solutions through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
"sec:cpe": [
{
"#text": "cpe:/a:ecovacs:ecovacs_pro",
"@product": "ECOVACS PRO",
"@vendor": "ECOVACS",
"@version": "2.2"
},
{
"#text": "cpe:/h:misc:hellohas_robotics_deebot_pro",
"@product": "DEEBOT PRO",
"@vendor": "Hellohas Robotics Inc.",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "7.5",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-026400",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU92804348/index.html",
"@id": "JVNVU#92804348",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2021-31698",
"@id": "CVE-2021-31698",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66403",
"@id": "CVE-2026-66403",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66404",
"@id": "CVE-2026-66404",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66405",
"@id": "CVE-2026-66405",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66406",
"@id": "CVE-2026-66406",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66407",
"@id": "CVE-2026-66407",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66408",
"@id": "CVE-2026-66408",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66409",
"@id": "CVE-2026-66409",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66410",
"@id": "CVE-2026-66410",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-66411",
"@id": "CVE-2026-66411",
"@source": "CVE"
},
{
"#text": "https://cwe.mitre.org/data/definitions/1391.html",
"@id": "CWE-1391",
"@title": "Use of Weak Credentials(CWE-1391)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/1395.html",
"@id": "CWE-1395",
"@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/295.html",
"@id": "CWE-295",
"@title": "Improper Certificate Validation(CWE-295)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/303.html",
"@id": "CWE-303",
"@title": "Incorrect Implementation of Authentication Algorithm(CWE-303)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/327.html",
"@id": "CWE-327",
"@title": "Use of a Broken or Risky Cryptographic Algorithm(CWE-327)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/489.html",
"@id": "CWE-489",
"@title": "Active Debug Code(CWE-489)"
}
],
"title": "Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App"
}
CVE-2021-31698 (GCVE-0-2021-31698)
Vulnerability from cvelistv5 – Published: 2021-08-12 21:33 – Updated: 2024-08-03 23:03
VLAI
EPSS
VEX
Summary
Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo_cfg input in atfwd_daemon.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://nns.ee/blog/2021/04/03/modem-rce.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:03:33.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nns.ee/blog/2021/04/03/modem-rce.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo_cfg input in atfwd_daemon."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-12T21:33:51.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nns.ee/blog/2021/04/03/modem-rce.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-31698",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo_cfg input in atfwd_daemon."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nns.ee/blog/2021/04/03/modem-rce.html",
"refsource": "MISC",
"url": "https://nns.ee/blog/2021/04/03/modem-rce.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-31698",
"datePublished": "2021-08-12T21:33:51.000Z",
"dateReserved": "2021-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:03:33.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-66403 (GCVE-0-2026-66403)
Vulnerability from cvelistv5 – Published: 2026-08-10 07:58 – Updated: 2026-08-10 17:47
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:46 UTC
CWE
- CWE-489 - Active debug code
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:46:47.636753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:47:06.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "Active debug code",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T07:58:47.505Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66403",
"datePublished": "2026-08-10T07:58:47.505Z",
"dateReserved": "2026-07-27T00:45:20.456Z",
"dateUpdated": "2026-08-10T17:47:06.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66404 (GCVE-0-2026-66404)
Vulnerability from cvelistv5 – Published: 2026-08-10 07:59 – Updated: 2026-08-10 17:47
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:45 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:45:23.387089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:47:47.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper certificate validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T07:59:17.344Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66404",
"datePublished": "2026-08-10T07:59:17.344Z",
"dateReserved": "2026-07-27T00:45:20.456Z",
"dateUpdated": "2026-08-10T17:47:47.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66405 (GCVE-0-2026-66405)
Vulnerability from cvelistv5 – Published: 2026-08-10 07:59 – Updated: 2026-08-10 17:52
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:51 UTC
CWE
- CWE-489 - Active debug code
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:51:13.013480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:52:26.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "Active debug code",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T07:59:40.861Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66405",
"datePublished": "2026-08-10T07:59:40.861Z",
"dateReserved": "2026-07-27T00:45:20.456Z",
"dateUpdated": "2026-08-10T17:52:26.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66406 (GCVE-0-2026-66406)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:00 – Updated: 2026-08-10 17:54
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.
A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:52 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:52:48.718647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:54:34.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.\r\nA man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper certificate validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:00:25.140Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66406",
"datePublished": "2026-08-10T08:00:25.140Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T17:54:34.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66407 (GCVE-0-2026-66407)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:00 – Updated: 2026-08-10 17:55
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.
The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:54 UTC
CWE
- CWE-327 - Use of a broken or risky cryptographic algorithm
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:54:57.313121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:21.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.\r\nThe WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "Use of a broken or risky cryptographic algorithm",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:00:43.341Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66407",
"datePublished": "2026-08-10T08:00:43.341Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T17:55:21.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66408 (GCVE-0-2026-66408)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:01 – Updated: 2026-08-10 17:57
VLAI
EPSS
VEX
Summary
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.
Physical access to an affected product may allow to obtain the password of the root account.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:56 UTC
CWE
- CWE-1391 - Use of weak credentials
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66408",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:56:54.655606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:57:46.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.\r\nPhysical access to an affected product may allow to obtain the password of the root account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "Use of weak credentials",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:01:00.420Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66408",
"datePublished": "2026-08-10T08:01:00.420Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T17:57:46.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66409 (GCVE-0-2026-66409)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:04 – Updated: 2026-08-10 18:05
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.
The password may be analyzed and obtained to connect to the access point of an affected robot.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 18:01 UTC
CWE
- CWE-1391 - Use of weak credentials
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T18:01:59.082529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:05:13.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.\r\nThe password may be analyzed and obtained to connect to the access point of an affected robot."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "Use of weak credentials",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:04:05.423Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66409",
"datePublished": "2026-08-10T08:04:05.423Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T18:05:13.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66410 (GCVE-0-2026-66410)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:08 – Updated: 2026-08-10 11:11
VLAI
EPSS
VEX
Summary
Android and iOS apps ECOVACS PRO App improperly validate server certificates.
Communication may be retrieved and/or altered.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 11:08 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | Android App "ECOVACS PRO" |
Affected:
0 , < 1.3.82
(semver)
|
|
| ECOVACS ROBOTICS | iOS App "ECOVACS PRO" |
Affected:
0 , < 1.3.82
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T11:08:48.975202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:11:44.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android App \"ECOVACS PRO\"",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "1.3.82",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iOS App \"ECOVACS PRO\"",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "1.3.82",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Android and iOS apps ECOVACS PRO App improperly validate server certificates.\r\nCommunication may be retrieved and/or altered."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper certificate validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:08:54.747Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66410",
"datePublished": "2026-08-10T08:08:54.747Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T11:11:44.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66411 (GCVE-0-2026-66411)
Vulnerability from cvelistv5 – Published: 2026-08-10 08:13 – Updated: 2026-08-10 11:01
VLAI
EPSS
VEX
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.
An unauthenticated attacker may connect and operate the affected robot.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 10:58 UTC
CWE
- CWE-303 - Incorrect Implementation of Authentication Algorithm
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ECOVACS ROBOTICS | DEEBOT PRO M1 |
Affected:
0 , < M1-1.7.27
(semver)
|
|
| ECOVACS ROBOTICS | DEEBOT PRO K1VAC |
Affected:
0 , < V1.7.821
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T10:58:14.457734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:01:17.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO M1",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "M1-1.7.27",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DEEBOT PRO K1VAC",
"vendor": "ECOVACS ROBOTICS",
"versions": [
{
"lessThan": "V1.7.821",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.\r\nAn unauthenticated attacker may connect and operate the affected robot."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "Incorrect Implementation of Authentication Algorithm",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T08:13:34.748Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://robot.hellohas.co.jp/news/update_20260331/"
},
{
"url": "https://jvn.jp/en/vu/JVNVU92804348/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-66411",
"datePublished": "2026-08-10T08:13:34.748Z",
"dateReserved": "2026-07-27T00:45:20.457Z",
"dateUpdated": "2026-08-10T11:01:17.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…