Executive brief
ECOVACS DEEBOT PRO robotic vacuums (M1 and K1VAC models) use a weak cryptographic algorithm for WebSocket communication authentication. An attacker positioned on the network can intercept traffic and extract the private key used for authentication, allowing them to intercept and modify communications with the robot—potentially accessing floor maps, logs, or taking control of the device.
Technical details
CVE-2026-66407 is a cryptographic weakness (CWE-327) in the WebSocket authentication implementation used by ECOVACS robotic vacuums. The vulnerability stems from the use of a broken or risky cryptographic algorithm to protect WebSocket private keys. An attacker positioned on the network path (man-in-the-middle) can analyze unencrypted or weakly encrypted traffic to extract the private key, no authentication or user interaction is required. Once the key is obtained, an attacker can decrypt, forge, and inject WebSocket messages, leading to information disclosure (floor maps, activity logs) or unauthorized device control. Firmware patches were released: M1 version 1.7.27 (January 2026) and K1VAC version V1.7.821 (March 2026); the fix includes migrating from WS to WSS (encrypted WebSocket protocol) and upgrading the token validation scheme.
Affected products
- ECOVACS DEEBOT PRO M1 prior to M1-1.7.27
- ECOVACS DEEBOT PRO K1VAC prior to V1.7.821
Timeline
- 2026-07-31: disclosed
- 2026-08-04: advisory
- 2026-01-31: patched: Initial patch released for M1 version M1-1.7.27 and K1VAC
- 2026-03-23: patched: Further update released for K1VAC version V1.7.821