Security flaws in Chinese robot vacuums expose indoor images in Korea
Korean regulators found that robot vacuums from Chinese manufacturers Narwal, Dreami, and Ecovacs had critical security flaws allowing unauthorized access to interior photographs and remote camera activation. Samsung and LG Electronics products were rated as having superior security; all companies completed remediation measures.
What happened
The Korean Consumer Agency and Korean Internet & Security Agency tested six robot vacuum models for security and found critical vulnerabilities in products from Narwal, Dreami, and Ecovacs. Narwal Freo Z Ultra (YJCC017) and Ecovacs Deebot X8 Pro Omni (DEX56) had insufficient user authentication, allowing third parties to access interior photos stored on cloud servers if they obtained a user's personal key or ID.
Dreami X50 Ultra (RLX85CE) had a security flaw allowing third parties to remotely force-activate the camera function even beyond the permissions they were granted, enabling real-time viewing of images and video through the vacuum's camera. Ecovacs products were also found to allow third parties to inject malicious image files into a user's phone photo gallery after registering the device on the mobile app.
Reported impact
The vulnerabilities exposed users' interior home photographs and allowed unauthorized surveillance through camera activation. The Dreami product's weak personal information management created risk of exposure of user names, contact numbers, and other personal data.
Index analysis
All six companies accepted the identified issues and completed remediation measures, which were verified by the agencies. The Roborock product showed no special vulnerabilities, while Samsung and LG Electronics products were rated as having superior security across authentication, access controls, password policies, and update mechanisms.
Governance controls
The agencies recommended security enhancements to all companies across mobile app authentication, hardware protection, and firmware security. All six manufacturers submitted quality improvement plans in response to the recommendations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.