Executive brief
ECOVACS DEEBOT PRO robotic vacuum cleaners use the wget command without verifying SSL/TLS server certificates, allowing attackers on the same network to intercept communications and inject malicious code that executes with administrative privileges. This creates a path for attackers to take control of the robot and potentially access stored data such as floor maps and activity logs.
Technical details
The vulnerability is a missing server certificate verification in wget command invocations (CWE-295), allowing man-in-the-middle (MITM) attacks. The root cause is that the firmware does not validate the SSL/TLS certificate of cloud platform servers when downloading content via wget. An attacker positioned on the network can intercept these unvalidated HTTPS connections and inject malicious payloads that are executed on the device with administrative privileges. This requires network adjacency and the attacker to intercept the specific wget request, but no authentication is required. The impact extends to arbitrary code execution, which could compromise the device and any sensitive data stored on it. Patches have been released: M1 firmware version 1.7.27 (released January 2026, updated March 2026) and K1VAC firmware version V1.7.821 (released March 2026).
Affected products
- ECOVACS DEEBOT PRO M1 prior to M1-1.7.27
- ECOVACS DEEBOT PRO K1VAC prior to V1.7.821
Timeline
- 2026-07-31: disclosed: Vulnerability published in JVN advisory
- 2026-01-31: patched: Initial firmware release with fixes (M1-1.7.27, K1VAC-1.7.82)
- 2026-03-23: patched: Additional patch released for K1VAC (V1.7.821) and library update for M1
- 2026-08-10: other: CVE-2026-66406 published