The affected Deebot Pro devices fail to verify server certificates during MQTT communication. This weakness means that any malicious actor who can intercept or inject traffic into the MQTT channel may read or alter the messages exchanged between the device and its server. The data exposed includes operation logs and activity logs that the devices store locally, which could contain sensitive user activity and scheduling information. The vulnerability does not appear to allow code execution or direct control over the device, but it does enable confidentiality compromise of logged data.

The flaw affects Ecovacs Robotics’ Deebot Pro K1VAC and Deebot Pro M1 models. No specific firmware revision is listed, so all current production binaries of these models are potentially vulnerable until a vendor fix is issued.

The CVSS score of 6 suggests moderate severity. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. The attack vector is inferred to be network-based: an attacker who can reach the MQTT broker used by the devices, either locally or over the internet if the broker is exposed, could mount a man‑in‑the‑middle attack to harvest logs. Because the device accepts unsigned certificates, a malicious broker could be substituted without any immediate detection. The impact is limited to compromise of confidential logs rather than direct loss of control of the robot.