CVE-2026-66406: Low severity DEEBOT PRO M1 vulnerability
DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Re-enable server certificate validation for the wget command (do not use wget with server certificate validation disabled) to prevent man-in-the-middle attacks from obtaining/altering communications.
DEEBOT PRO M1 and DEEBOT PRO K1VAC (wget) server certificate validation = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66406?
The severity of CVE-2026-66406 is medium with a CVSS score of 4.8.
What is CVE-2026-66406 about?
CVE-2026-66406 describes a vulnerability in DEEBOT PRO M1 and DEEBOT PRO K1VAC, which uses the wget command without server certificate validation.
How can CVE-2026-66406 be exploited?
CVE-2026-66406 can be exploited through a man-in-the-middle attack to obtain or alter communications of the affected products.
How do I fix CVE-2026-66406?
To fix CVE-2026-66406, ensure that server certificate validation is enabled when using the wget command.
What are the potential impacts of CVE-2026-66406?
The potential impacts of CVE-2026-66406 include arbitrary code execution with administrative privileges if the vulnerability is exploited.