DJI ROMO Robot Vacuums Security Flaw Exposed Thousands to Privacy Breach
A vulnerability in DJI ROMO robot vacuums allowed unauthorized access to approximately 7,000 devices across 24 countries. The security flaw in the device authentication system permitted an individual to view live video feeds, audio, and home maps from thousands of homes. DJI deployed patches in February 2026 to resolve the issue.
What happened
A vulnerability in DJI ROMO robot vacuum authentication was discovered by developer Sammy Azdoufal when he attempted to connect his own device to a PlayStation 5 controller. By extracting a private token from his ROMO device, Azdoufal found he could access data and controls of approximately 7,000 ROMO vacuums across 24 countries within nine minutes.
The security flaw resided in the DJI Home backend's MQTT protocol validation, where the server failed to verify that access permissions corresponded only to a user's own device. When the server received a token, it did not properly validate that the token's permissions matched the specific robot being accessed, allowing a single token to act as a universal key across the entire infrastructure.
Reported impact
Unauthorized access provided real-time video feeds, audio, detailed home maps, device serial numbers, cleaning status, and battery levels from affected homes. The vulnerability exposed personal data and enabled remote control of thousands of robot vacuums across multiple countries.
The case highlighted privacy and security risks in connected smart home devices, particularly the presence of cameras and microphones in everyday appliances connected to the internet.
Index analysis
DJI identified the vulnerability at the end of January and deployed an initial patch on February 8, though it did not apply correctly across all servers. A second update was deployed on February 10 to ensure the fix was extended throughout the entire infrastructure, and DJI stated the problem was subsequently resolved.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.