# CVE-2026-66408: ECOVACS DEEBOT PRO weak root account password

Source: https://junglewise.ai/threats/cve-2026-66408-ecovacs-deebot-pro-weak-root-account-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66408 · Severity: medium · CVSS 4.6 · Published 2026-08-10

ECOVACS DEEBOT PRO robotic vacuum cleaners (M1 and K1VAC models) are configured with weak passwords for the root administrator account. An attacker with physical access to the device can obtain the root password through reverse engineering or analysis, leading to complete system compromise and unauthorized control of the robot, access to stored maps and logs, and potential network access if the device is connected to the home network.

Technologies: [Ecovacs DEEBOT PRO K1VAC](https://junglewise.ai/threats/technologies/deebot-pro-k1vac), [Ecovacs DEEBOT PRO M1](https://junglewise.ai/threats/technologies/deebot-pro-m1). Vendors: [Ecovacs](https://junglewise.ai/threats/vendors/ecovacs).

## Quick answers

**Is CVE-2026-66408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66408 being exploited in the wild.

**How severe is CVE-2026-66408?** Medium severity, with a CVSS score of 4.6, published 10 August 2026.

**Which products and versions are affected?** Ecovacs DEEBOT PRO K1VAC prior to V1.7.821; Ecovacs DEEBOT PRO M1 prior to M1-1.7.27.

**Is there a fix for CVE-2026-66408?** A patch was published on 2026-01-31: Firmware versions M1-1.7.27 and K1VAC-1.7.82 released; K1VAC further updated March 23, 2026 to V1.7.821 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66408 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-66408?** Check whether you run Ecovacs DEEBOT PRO K1VAC or Ecovacs DEEBOT PRO M1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a weak password configuration (CWE-1391) affecting the root account on DEEBOT PRO M1 (prior to M1-1.7.27) and DEEBOT PRO K1VAC (prior to V1.7.821). The attack requires physical access to the device to extract or analyze the password, allowing an attacker to gain administrative privileges. Once root access is obtained, an attacker can execute arbitrary commands, modify device configuration, access stored floor maps and activity logs, and potentially use the device as a pivot point into the home network. Patches are available; Hellohas Robotics released firmware updates in January 2026 (M1-1.7.27, K1VAC-1.7.82) with a follow-up library update for M1 in March 2026.

## Affected products

- ECOVACS DEEBOT PRO M1 prior to M1-1.7.27
- ECOVACS DEEBOT PRO K1VAC prior to V1.7.821

## Timeline

- 2026-07-31: disclosed
- 2026-01-31: patched: Firmware versions M1-1.7.27 and K1VAC-1.7.82 released; K1VAC further updated March 23, 2026 to V1.7.821

## References

- [https://jvn.jp/en/vu/JVNVU92804348/](https://jvn.jp/en/vu/JVNVU92804348/)
- [https://robot.hellohas.co.jp/news/update_20260331/](https://robot.hellohas.co.jp/news/update_20260331/)

## Related threats

- [Ecovacs DEEBOT PRO authentication bypass in WebSocket](https://junglewise.ai/threats/cve-2026-66411-ecovacs-deebot-pro-authentication-bypass-in-websocket)
- [ECOVACS DEEBOT PRO weak Wi-Fi hotspot password](https://junglewise.ai/threats/cve-2026-66409-ecovacs-deebot-pro-weak-wi-fi-hotspot-password)
- [ECOVACS DEEBOT PRO broken cryptographic algorithm in WebSocket authentication](https://junglewise.ai/threats/cve-2026-66407-ecovacs-deebot-pro-broken-cryptographic-algorithm-in-websocket)
- [ECOVACS DEEBOT PRO M1 and K1VAC man-in-the-middle attack via wget without certificate validation](https://junglewise.ai/threats/cve-2026-66406-ecovacs-deebot-pro-m1-and-k1vac-man-in-the-middle-attack-via-wget)
- [ECOVACS DEEBOT PRO telnet authentication bypass](https://junglewise.ai/threats/cve-2026-66405-ecovacs-deebot-pro-telnet-authentication-bypass)