CVE-2026-66403: DEEBOT PRO Info Disclosure Vulnerability

CVE-2026-66403 Overview

CVE-2026-66403 affects the DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum products. The devices ship with a debugging web server enabled in production firmware. Remote attackers on the network can reach this interface without authentication and retrieve stored floor maps and log information from the affected devices.

The vulnerability is categorized under [CWE-489] Active Debug Code. Leaving debug functionality exposed on shipped hardware violates least-privilege and secure-defaults principles for Internet of Things (IoT) devices.

Critical Impact
Unauthenticated network attackers can retrieve floor maps and internal logs from affected DEEBOT robots, exposing physical layout data of homes and offices along with device telemetry.

Affected Products

DEEBOT PRO M1
DEEBOT PRO K1VAC
Firmware versions prior to the vendor update referenced in the HelloHas advisory

Discovery Timeline

2026-08-10 - CVE-2026-66403 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-66403

Vulnerability Analysis

The affected DEEBOT PRO M1 and DEEBOT PRO K1VAC devices ship with a web server intended for internal debugging left enabled in production firmware. The service listens on the network and does not enforce authentication for the exposed endpoints. Any attacker with network reachability to the device can request stored data.

According to the advisory, the exposed data includes the floor map generated by the robot's simultaneous localization and mapping (SLAM) subsystem, along with log information written by device processes. Floor maps disclose the physical layout of the deployment location, which is sensitive for residential and enterprise environments.

The attack requires no user interaction and no privileges. The classification aligns with [CWE-489] Active Debug Code, a design flaw where development or diagnostic interfaces remain enabled after release. The current Exploit Prediction Scoring System (EPSS) probability is 0.432%.

Root Cause

The root cause is a build and release configuration flaw. The firmware image distributed to customers contains a debug HTTP service that should have been disabled or removed before production. No authentication layer gates the debug endpoints, so the service treats every network peer as a trusted developer.

Attack Vector

Exploitation is network-based. An attacker on the same local area network (LAN) as the vacuum, or on any network segment that can route to the device, issues HTTP requests to the debug web server and retrieves floor map files and log data. Attackers who compromise a home router or a colocated device on the network can enumerate DEEBOT products and pull the stored artifacts. See the JVN Vulnerability Report for the coordinated disclosure details.

Detection Methods for CVE-2026-66403

Indicators of Compromise

Unexpected inbound HTTP connections to DEEBOT PRO M1 or K1VAC devices from hosts other than the mobile companion app
Outbound transfers of floor map files or log archives from the robot's IP address to unknown destinations
Presence of an open, unauthenticated HTTP service on the device that responds to debug endpoints

Detection Strategies

Perform network discovery scans on the LAN to enumerate DEEBOT devices and check whether a debug web server responds to unauthenticated requests
Inspect DHCP and Address Resolution Protocol (ARP) tables for DEEBOT hardware and correlate with firmware versions listed in the HelloHas Update Announcement
Review network flow records for any HTTP traffic to the vacuum originating from hosts outside the expected mobile client

Monitoring Recommendations

Monitor IoT VLAN egress for unusual data transfers from robotic vacuum devices
Alert on any inbound HTTP request to the device from an untrusted subnet
Track firmware versions of DEEBOT devices in an asset inventory and flag any device that has not been updated to the fixed release

How to Mitigate CVE-2026-66403

Immediate Actions Required

Apply the firmware update referenced in the HelloHas Update Announcement to every DEEBOT PRO M1 and DEEBOT PRO K1VAC device
Place affected robots on an isolated IoT VLAN that blocks inbound connections from user and guest networks
Verify the debug web server no longer responds after the update by probing the device on the previously exposed port

Patch Information

The vendor has published a firmware update through HelloHas that disables the debug web server. Consult the JVN Vulnerability Report and the HelloHas Update Announcement for the specific firmware version and installation procedure.

Workarounds

Block network access to the debug port on the device using host firewall rules on the LAN gateway until the firmware is applied
Disconnect affected devices from Wi-Fi if patching cannot be completed and floor map confidentiality is a concern
Segment IoT devices onto a dedicated network with no route to workstations or servers that could pivot to the debug interface

bash

# Example: block inbound HTTP to the DEEBOT device IP on an OpenWrt gateway
iptables -I FORWARD -d <deebot_ip> -p tcp --dport 80 -j DROP
iptables -I FORWARD -d <deebot_ip> -p tcp --dport 8080 -j DROP