CVE-2026-66407

The CVE rates 8.1, but the severity is fundamentally about what this robot can do—map your home, record audio, move autonomously through your living spaces—rather than the technical complexity of exploitation. The vulnerability stems from a static authentication key transmitted over the WebSocket connection used to control the DEEBOT. WebSocket has no built-in authentication; developers must implement it themselves, and static shared secrets are the path of least resistance in IoT development. Once that key is extracted from traffic on any network the robot joins, an attacker gains complete control: camera feed, microphone, navigation commands, scheduled cleaning routines. The Adjacent Network (AV:A) requirement in the CVSS vector means physical or WiFi proximity is needed to capture the traffic initially. However, this constraint has eroded over the past decade as guest networks become common, IoT botnets serve as pivot points, and smart home ecosystems increasingly assume device-to-device trust on local networks. Once the key is extracted, it becomes a permanent artifact—an attacker can store it and use it whenever they later gain network access. Your defensive priorities: First, determine whether the compromised key can be rotated through a firmware update, or whether it is baked into immutable firmware. If the latter, the device may require replacement—check whether Ecovacs has issued a recall or extended warranty. Second, and critically, the static key also exists in the companion mobile application. Any APK extraction yields the key even if the robot itself is patched. Verify whether Ecovacs has issued an app update that rotates or revokes the shared secret—patching the robot while leaving the app unchanged leaves the key extractable and usable against older firmware in the field. Finally, assess whether other Ecovacs products sharing the same cloud infrastructure or authentication libraries are affected. The commit that introduced this pattern often propagates across product lines. The key unlocks the WebSocket endpoint; audit what other operations that endpoint permits beyond robot control.

Reviewed through automated stages and approved by a human before publication.