VulnerabilityDeferred

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled.

HIGH 8.7EPSS 0.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-489
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/vu/JVNVU92804348/
https://robot.hellohas.co.jp/news/update_20260331/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.