Description

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-10T09:17:23.483Z",
  "pubdate": "2026-08-10T09:17:23.483Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified within the WebSocket communications implementation of the DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic systems. This security flaw stems from an incorrect implementation of the underlying authentication algorithm, which fails to adequately validate connecting clients.\nConsequently, an unauthenticated, network-adjacent attacker can successfully establish a WebSocket connection directly to the affected robot without supplying valid credentials or cryptographic tokens. Upon establishing this unauthorized connection, the malicious actor gains the capability to execute operational commands and control the physical behavior of the target robotic system.\nThe risk implications are severe, as unauthorized remote operation of autonomous commercial robots can lead to physical safety hazards, disruption of facility operations, and potential espionage or surveillance risks within the deployment environment.\nExploitation of this vulnerability requires network access to the WebSocket interface exposed by the DEEBOT PRO M1 or DEEBOT PRO K1VAC. No prior authentication, special privileges, or complex exploitation payloads are required to interact with the device once network connectivity is established.",
  "technicalDetails": "The vulnerability resides within the WebSocket communication subsystem of the DEEBOT PRO M1 and DEEBOT PRO K1VAC products. The root cause of the flaw is an improper implementation of the authentication algorithm governing WebSocket handshakes and subsequent message exchanges.\nDuring the establishment of the WebSocket connection or the initial protocol handshake, the vulnerable component fails to properly enforce cryptographic verification or session validation checks. Instead of rejecting unauthenticated or improperly signed connection requests, the affected WebSocket daemon improperly processes the incoming streams and treats the unverified socket as a legitimate, authenticated session.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection to the designated WebSocket port or endpoint exposed by the target DEEBOT PRO M1 or DEEBOT PRO K1VAC robot. Second, the attacker initiates the standard WebSocket upgrade request without providing any valid authentication headers, tokens, or cryptographic signatures. Third, due to the flawed authentication algorithm, the device accepts the handshake and opens the WebSocket channel. Fourth, the attacker transmits arbitrary operational commands encapsulated in the expected WebSocket payload format. Finally, the robot parses and executes these unauthorized commands, resulting in direct operational control over the device.\nThe vulnerable component is the WebSocket server implementation responsible for client session management and command routing. The affected versions include DEEBOT PRO M1 and DEEBOT PRO K1VAC. The network exposure is characterized by accessibility over the local network interface where the WebSocket service listens for incoming control traffic. The authentication requirement is effectively bypassed due to the algorithmic defect, and no privilege requirements are necessary for the attacker.\nPost-exploitation impact includes full operational control over the affected robotic units, enabling malicious actors to manipulate navigation, initiate unauthorized cleaning or service routines, potentially access onboard sensor data streams, and physically navigate the robot into restricted areas or obstacles, causing hardware damage or safety incidents."
}