Is CVE-2026-66407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66407 being exploited in the wild.

How severe is CVE-2026-66407?

High severity, with a CVSS score of 8.1, published 10 August 2026.

Which products and versions are affected?

Ecovacs DEEBOT PRO K1VAC prior to V1.7.821; Ecovacs DEEBOT PRO M1 prior to M1-1.7.27.

Is there a fix for CVE-2026-66407?

A patch was published on 2026-01-31: Initial patch released for M1 version M1-1.7.27 and K1VAC Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66407 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66407?

Check whether you run Ecovacs DEEBOT PRO K1VAC or Ecovacs DEEBOT PRO M1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66407: ECOVACS DEEBOT PRO broken cryptographic algorithm in WebSocket authentication

CVE-2026-66407 · Severity: high · CVSS 8.1 · Published 2026-08-10

ECOVACS DEEBOT PRO robotic vacuums (M1 and K1VAC models) use a weak cryptographic algorithm for WebSocket communication authentication. An attacker positioned on the network can intercept traffic and extract the private key used for authentication, allowing them to intercept and modify communications with the robot—potentially accessing floor maps, logs, or taking control of the device.

Technologies: Ecovacs DEEBOT PRO K1VAC, Ecovacs DEEBOT PRO M1. Vendors: Ecovacs.

Quick answers

Is CVE-2026-66407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66407 being exploited in the wild.
How severe is CVE-2026-66407?: High severity, with a CVSS score of 8.1, published 10 August 2026.
Which products and versions are affected?: Ecovacs DEEBOT PRO K1VAC prior to V1.7.821; Ecovacs DEEBOT PRO M1 prior to M1-1.7.27.
Is there a fix for CVE-2026-66407?: A patch was published on 2026-01-31: Initial patch released for M1 version M1-1.7.27 and K1VAC Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66407 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66407?: Check whether you run Ecovacs DEEBOT PRO K1VAC or Ecovacs DEEBOT PRO M1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-66407 is a cryptographic weakness (CWE-327) in the WebSocket authentication implementation used by ECOVACS robotic vacuums. The vulnerability stems from the use of a broken or risky cryptographic algorithm to protect WebSocket private keys. An attacker positioned on the network path (man-in-the-middle) can analyze unencrypted or weakly encrypted traffic to extract the private key, no authentication or user interaction is required. Once the key is obtained, an attacker can decrypt, forge, and inject WebSocket messages, leading to information disclosure (floor maps, activity logs) or unauthorized device control. Firmware patches were released: M1 version 1.7.27 (January 2026) and K1VAC version V1.7.821 (March 2026); the fix includes migrating from WS to WSS (encrypted WebSocket protocol) and upgrading the token validation scheme.

Affected products

ECOVACS DEEBOT PRO M1 prior to M1-1.7.27
ECOVACS DEEBOT PRO K1VAC prior to V1.7.821

Timeline

2026-07-31: disclosed
2026-08-04: advisory
2026-01-31: patched: Initial patch released for M1 version M1-1.7.27 and K1VAC
2026-03-23: patched: Further update released for K1VAC version V1.7.821

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.