CVE-2026-66410: ECOVACS PRO App Certificate Flaw

CVE-2026-66410 Overview

CVE-2026-66410 affects the ECOVACS PRO mobile applications for Android and iOS. The applications improperly validate server certificates during Transport Layer Security (TLS) sessions. This weakness, categorized as [CWE-295] Improper Certificate Validation, allows attackers positioned on the network to intercept or modify communications between the app and its backend services. An attacker capable of presenting a crafted or fraudulent certificate can decrypt session content or inject altered responses. The flaw requires network-adjacent positioning and user interaction to trigger, which limits opportunistic exploitation. No public exploit code or evidence of in-the-wild abuse has been reported.

Critical Impact
Attackers within the network path can retrieve or alter traffic between the ECOVACS PRO App and its servers, exposing credentials and control commands.

Affected Products

ECOVACS PRO App for Android
ECOVACS PRO App for iOS
Deployments relying on the vulnerable client certificate validation logic

Discovery Timeline

2026-08-10 - CVE-2026-66410 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-66410

Vulnerability Analysis

The ECOVACS PRO App establishes TLS sessions with backend services to relay commands, telemetry, and account data. The client does not correctly verify the server certificate chain presented during the TLS handshake. An attacker performing a machine-in-the-middle (MITM) attack can present a certificate that would normally be rejected, and the app proceeds with the session. This class of flaw commonly arises from disabled hostname verification, acceptance of self-signed certificates, or use of a permissive trust manager. The result is a broken confidentiality and integrity guarantee for all traffic the app carries.

Root Cause

The root cause is improper certificate validation in the mobile client, tracked as [CWE-295]. The app trusts server certificates that a correctly implemented TLS client would reject. Typical implementation errors in this category include overriding platform trust stores, accepting any certificate returned by the server, or skipping hostname checks against the certificate Subject Alternative Name (SAN).

Attack Vector

Exploitation requires an attacker to sit on the network path between the mobile device and the ECOVACS backend. Common positions include compromised Wi-Fi access points, rogue hotspots, or ARP or DNS spoofing on shared networks. The attacker terminates the TLS session with a fraudulent certificate and forwards traffic to the legitimate server. Because the client accepts the certificate, the user sees no warning, and the attacker observes or modifies commands, authentication tokens, and telemetry in transit.

No verified proof-of-concept code has been published. Refer to the JVN Vulnerability Report and the HelloHas Security Update for vendor technical details.

Detection Methods for CVE-2026-66410

Indicators of Compromise

Unexpected TLS session terminations to hosts other than published ECOVACS backend endpoints from mobile devices running the PRO App.
Presence of untrusted or unknown root certificates injected into user or device trust stores on managed mobile devices.
DNS responses for ECOVACS backend domains resolving to non-vendor IP ranges on the local network.

Detection Strategies

Perform TLS inspection on egress from corporate Wi-Fi to identify mobile clients accepting certificates from unexpected issuers.
Use mobile device management (MDM) posture checks to flag installations of the ECOVACS PRO App on managed devices until patched.
Correlate authentication anomalies on the ECOVACS backend, such as logins from unfamiliar IP addresses following network events, if telemetry is available to the operator.

Monitoring Recommendations

Alert on ARP table changes and gateway MAC address flips on segments where affected mobile devices connect.
Log and review DNS queries for ECOVACS-associated domains from mobile subnets to identify redirection attempts.
Track outbound TLS connections from mobile devices and baseline expected server certificate fingerprints.

How to Mitigate CVE-2026-66410

Immediate Actions Required

Update the ECOVACS PRO App on all Android and iOS devices to the version identified in the vendor advisory.
Restrict use of the app to trusted networks until patched, and avoid public or untrusted Wi-Fi.
Rotate any account credentials that may have been transmitted through the vulnerable client.

Patch Information

Refer to the vendor coordination notice published in the JVN Vulnerability Report and the related HelloHas Security Update for fixed application versions and release details. Install updates through the official Google Play Store or Apple App Store distribution channels.

Workarounds

Route mobile device traffic through a trusted virtual private network (VPN) to reduce exposure to local network attackers.
Disable use of the ECOVACS PRO App on networks that cannot be verified as trusted until the patched version is installed.
Enforce mobile device management policies that block installation of unpatched versions on enterprise-managed devices.

bash

# Example: query installed ECOVACS PRO App version on an Android device via adb
adb shell dumpsys package com.ecovacs.pro | grep versionName