CVE-2026-66406
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.
Risk Assessment
An attacker can intercept communication and execute malicious code on the robot, potentially leading to full compromise of the device and privacy breaches.
Recommendation
Update the robot firmware to a patched version and avoid using untrusted networks.
Original NVD description (English source)
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.