CVE Catalog
CVE-2026-66404
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.20%
10th percentile - higher than 10% of all known CVEs
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
Risk Assessment
An attacker can intercept MQTT communication and access operation and activity logs, potentially revealing sensitive user information.
Recommendation
Update the robot firmware to a patched version and consider encrypting MQTT communication.
Original NVD description (English source)
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.