# CVE-2026-66406: ECOVACS DEEBOT PRO M1 and K1VAC man-in-the-middle attack via wget without certificate validation

Source: https://junglewise.ai/threats/cve-2026-66406-ecovacs-deebot-pro-m1-and-k1vac-man-in-the-middle-attack-via-wget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66406 · Severity: medium · CVSS 4.8 · Published 2026-08-10

ECOVACS DEEBOT PRO robotic vacuum cleaners use the wget command without verifying SSL/TLS server certificates, allowing attackers on the same network to intercept communications and inject malicious code that executes with administrative privileges. This creates a path for attackers to take control of the robot and potentially access stored data such as floor maps and activity logs.

Technologies: [Ecovacs DEEBOT PRO K1VAC](https://junglewise.ai/threats/technologies/deebot-pro-k1vac), [Ecovacs DEEBOT PRO M1](https://junglewise.ai/threats/technologies/deebot-pro-m1). Vendors: [Ecovacs](https://junglewise.ai/threats/vendors/ecovacs).

## Quick answers

**Is CVE-2026-66406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66406 being exploited in the wild.

**How severe is CVE-2026-66406?** Medium severity, with a CVSS score of 4.8, published 10 August 2026.

**Which products and versions are affected?** Ecovacs DEEBOT PRO K1VAC prior to V1.7.821; Ecovacs DEEBOT PRO M1 prior to M1-1.7.27.

**Is there a fix for CVE-2026-66406?** A patch was published on 2026-01-31: Initial firmware release with fixes (M1-1.7.27, K1VAC-1.7.82) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66406 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-66406?** Check whether you run Ecovacs DEEBOT PRO K1VAC or Ecovacs DEEBOT PRO M1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing server certificate verification in wget command invocations (CWE-295), allowing man-in-the-middle (MITM) attacks. The root cause is that the firmware does not validate the SSL/TLS certificate of cloud platform servers when downloading content via wget. An attacker positioned on the network can intercept these unvalidated HTTPS connections and inject malicious payloads that are executed on the device with administrative privileges. This requires network adjacency and the attacker to intercept the specific wget request, but no authentication is required. The impact extends to arbitrary code execution, which could compromise the device and any sensitive data stored on it. Patches have been released: M1 firmware version 1.7.27 (released January 2026, updated March 2026) and K1VAC firmware version V1.7.821 (released March 2026).

## Affected products

- ECOVACS DEEBOT PRO M1 prior to M1-1.7.27
- ECOVACS DEEBOT PRO K1VAC prior to V1.7.821

## Timeline

- 2026-07-31: disclosed: Vulnerability published in JVN advisory
- 2026-01-31: patched: Initial firmware release with fixes (M1-1.7.27, K1VAC-1.7.82)
- 2026-03-23: patched: Additional patch released for K1VAC (V1.7.821) and library update for M1
- 2026-08-10: other: CVE-2026-66406 published

## References

- [https://jvn.jp/en/vu/JVNVU92804348/](https://jvn.jp/en/vu/JVNVU92804348/)
- [https://robot.hellohas.co.jp/news/update_20260331/](https://robot.hellohas.co.jp/news/update_20260331/)

## Related threats

- [Ecovacs DEEBOT PRO authentication bypass in WebSocket](https://junglewise.ai/threats/cve-2026-66411-ecovacs-deebot-pro-authentication-bypass-in-websocket)
- [ECOVACS DEEBOT PRO weak Wi-Fi hotspot password](https://junglewise.ai/threats/cve-2026-66409-ecovacs-deebot-pro-weak-wi-fi-hotspot-password)
- [ECOVACS DEEBOT PRO weak root account password](https://junglewise.ai/threats/cve-2026-66408-ecovacs-deebot-pro-weak-root-account-password)
- [ECOVACS DEEBOT PRO broken cryptographic algorithm in WebSocket authentication](https://junglewise.ai/threats/cve-2026-66407-ecovacs-deebot-pro-broken-cryptographic-algorithm-in-websocket)
- [ECOVACS DEEBOT PRO telnet authentication bypass](https://junglewise.ai/threats/cve-2026-66405-ecovacs-deebot-pro-telnet-authentication-bypass)