{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
  "dc:date": "2026-08-05T12:28+09:00",
  "dcterms:issued": "2026-08-04T14:10+09:00",
  "dcterms:modified": "2026-08-05T12:28+09:00",
  "description": "Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc.\u003cul\u003e\u003cli\u003eweb server for debugging purposes remains enabled (CWE-489) - CVE-2026-66403\u003c/li\u003e\u003cli\u003eMissing server certificate verification in MQTT communications (CWE-295) - CVE-2026-66404\u003c/li\u003e\u003cli\u003etelnet server remains enabled (CWE-489) - CVE-2026-66405\u003c/li\u003e\u003cli\u003eMissing server certificate verification in wget command (CWE-295) - CVE-2026-66406\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected product.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eUse of a Broken or Risky Cryptographic Algorithm in WebSocket communication authentication (CWE-327) - CVE-2026-66407\u003c/li\u003e\u003cul\u003e\u003cli\u003eA man-in-the-middle attack could allow an attacker to analyze the WebSocket private key.\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eWeak password for root account (CWE-1391) - CVE-2026-66408\u003c/li\u003e\u003cli\u003eWeak password for Wi-Fi hotspot network (CWE-1391) - CVE-2026-66409\u003c/li\u003e\u003cli\u003eImproper server certificate verification in the smartphone app (CWE-295) - CVE-2026-66410\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395)\u003c/li\u003e\u003cul\u003e\u003cli\u003eKnown vulnerability in Quectel EG25-G device (CVE-2021-31698)\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eIncorrect implementation of authentication algorithm in Websocket communications (CWE-303) - CVE-2026-66411\u003c/li\u003e\u003c/ul\u003eHellohas Robotics Inc. reported and coordinated these vulnerabilities with ECOVACS ROBOTICS, and reported to JPCERT/CC to notify users of the solutions through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026400.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:ecovacs:ecovacs_pro",
      "@product": "ECOVACS PRO",
      "@vendor": "ECOVACS",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:misc:hellohas_robotics_deebot_pro",
      "@product": "DEEBOT PRO",
      "@vendor": "Hellohas Robotics Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-026400",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92804348/index.html",
      "@id": "JVNVU#92804348",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2021-31698",
      "@id": "CVE-2021-31698",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66403",
      "@id": "CVE-2026-66403",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66404",
      "@id": "CVE-2026-66404",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66405",
      "@id": "CVE-2026-66405",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66406",
      "@id": "CVE-2026-66406",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66407",
      "@id": "CVE-2026-66407",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66408",
      "@id": "CVE-2026-66408",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66409",
      "@id": "CVE-2026-66409",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66410",
      "@id": "CVE-2026-66410",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-66411",
      "@id": "CVE-2026-66411",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1391.html",
      "@id": "CWE-1391",
      "@title": "Use of Weak Credentials(CWE-1391)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1395.html",
      "@id": "CWE-1395",
      "@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/295.html",
      "@id": "CWE-295",
      "@title": "Improper Certificate Validation(CWE-295)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/303.html",
      "@id": "CWE-303",
      "@title": "Incorrect Implementation of Authentication Algorithm(CWE-303)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/327.html",
      "@id": "CWE-327",
      "@title": "Use of a Broken or Risky Cryptographic Algorithm(CWE-327)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/489.html",
      "@id": "CWE-489",
      "@title": "Active Debug Code(CWE-489)"
    }
  ],
  "title": "Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App"
}