Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T09:17:22.483Z",
  "pubdate": "2026-08-10T09:17:22.483Z",
  "executiveSummary": "An unvalidated server certificate vulnerability exists in the MQTT communications implementation of the DEEBOT PRO M1 and DEEBOT PRO K1VAC products. This security deficiency allows malicious actors positioned on the network path to intercept and compromise sensitive telemetry data transmitted between the affected devices and remote servers. Specifically, operation logs and activity logs stored locally on the impacted robotic systems can be retrieved by unauthorized third parties due to the absence of proper cryptographic trust verification during the TLS handshake phase of the MQTT protocol implementation. The risk implications include unauthorized disclosure of sensitive operational telemetry and potential exposure of internal device activity history to network-based adversaries capable of performing Man-in-the-Middle (MitM) attacks. The attacker capabilities required to exploit this weakness involve network positioning to intercept or manipulate traffic traversing the communication channel between the client device and the message broker. Since the target devices fail to enforce X.509 certificate validation, no specialized cryptographic bypass is necessary for an adversary to establish a deceptive communication session and harvest plaintext or improperly encrypted operational data.",
  "technicalDetails": "The root cause of the vulnerability lies within the TLS/SSL implementation utilized by the MQTT communication module in the DEEBOT PRO M1 and DEEBOT PRO K1VAC. Specifically, the affected software fails to validate the authenticity of the remote server's digital certificate presented during the establishment of secure socket connections over the MQTT protocol. This critical omission permits the client application to accept self-signed, expired, or otherwise untrusted certificates without raising security exceptions, effectively negating the confidentiality and integrity guarantees typically provided by transport layer security.\nThe vulnerable component is the MQTT client networking library responsible for orchestrating telemetry transmission, command reception, and log synchronization with backend infrastructure. Network exposure is inherent to the IoT architecture of these robotic systems, which continuously communicate over local or wide-area networks to report status updates and receive operational directives. Because mutual authentication and strict trust chain validation are bypassed, an adversary positioned adjacently on the network or capable of executing ARP poisoning, DNS spoofing, or router-level redirection can instantiate a Man-in-the-Middle (MitM) positioning attack.\nThe step-by-step attack flow proceeds as follows: First, the attacker intercepts the initial connection request or DNS resolution lookup initiated by the DEEBOT PRO M1 or DEEBOT PRO K1VAC toward the intended MQTT broker. Second, the adversary interposes their own proxy server or rogue listener between the target device and the legitimate infrastructure. Third, when the device initiates the TLS handshake to establish the secure MQTT session, the rogue intermediary presents an arbitrary or self-signed server certificate. Fourth, rather than verifying the certificate against a trusted root certificate authority (CA) store and validating domain name bindings, the device accepts the invalid certificate unconditionally. Fifth, the secure tunnel is established between the device and the attacker's infrastructure. Finally, the adversary can passively eavesdrop upon or actively request sensitive stored payloads, specifically including operation logs and activity logs, which are transmitted over the compromised transport layer without cryptographic protection against interception."
}