DJI Robot Vacuum Hack: Security Flaw Exposed Thousands of Devices

A security vulnerability in DJI’s Romo robot vacuum cleaners allowed an independent engineer to remotely access and control over 6,700 devices worldwide. The incident, discovered in February 2026 by Sammy Azdoufal, highlights the potential security risks associated with increasingly connected home devices. While the engineer promptly reported the flaw to DJI, the incident underscores the importance of robust server-side access controls and data handling practices in the Internet of Things (IoT) ecosystem.

How the Access Was Gained

Azdoufal, while attempting to create a custom remote control application for the Romo vacuum using a PlayStation 5 controller, inadvertently discovered a pathway to gain extensive control over the devices. This wasn’t a traditional system breach involving hacking or exploiting a known vulnerability, but rather a consequence of improperly configured server-side access controls. He was able to access floor plans, live video feeds, and gain full remote operational control. The vulnerability stemmed from how the Romo vacuums communicated with DJI’s servers, allowing unauthorized access to sensitive data and control functions.

DJI responded swiftly, releasing system updates to address the identified security flaw. Yet, initial reports indicated that some security concerns remained even after the updates, including the ability to access video feeds without requiring a security PIN. This raises questions about the thoroughness of the initial fix and the ongoing security posture of the devices.

DJI and U.S. Security Concerns: A Broader Context

The Romo vacuum incident isn’t an isolated event for DJI. The company, primarily known for its drone technology, has faced increasing scrutiny from U.S. Authorities over national security concerns for years. As early as 2017, the U.S. Army prohibited service members from using DJI drones, citing cybersecurity risks and ordering the removal of related applications and storage media. DJI was subsequently added to a Pentagon watch list, fueling concerns that its drones could potentially compromise sensitive government information and facilities.

These concerns led to restrictions imposed by the Federal Communications Commission (FCC), which banned the import of new DJI models and drone components. In February 2026, DJI filed a lawsuit against the FCC, arguing that the restrictions unfairly limited its U.S. Operations. This legal challenge is ongoing, reflecting the complex interplay between technological innovation, national security, and international trade.

Azdoufal’s Reward and the Bug Bounty Program

DJI acknowledged the significance of Azdoufal’s discovery by awarding him a $30,000 reward. The payment was communicated via email, though DJI was initially unclear about which specific finding triggered the payout. The company later confirmed the reward to The Verge via Tom’s Hardware, but refrained from providing specific details about Azdoufal’s findings. This incident highlights the growing trend of bug bounty programs, where companies incentivize security researchers to identify and report vulnerabilities in their systems.

Implications for IoT Security

The Romo vacuum incident serves as a stark reminder of the security challenges inherent in the rapidly expanding IoT landscape. As more devices become connected to the internet, the potential attack surface for malicious actors increases exponentially. The vulnerability wasn’t a sophisticated hack, but a result of basic security oversights in access control and data handling. This suggests that many IoT devices may be vulnerable to similar exploits, even without complex hacking skills.

The incident also raises questions about the responsibility of manufacturers to prioritize security in the design and development of IoT devices. While DJI responded to the vulnerability, the initial presence of security flaws – such as the ability to access video feeds without a PIN – suggests a need for more rigorous security testing and proactive vulnerability management.

What Comes Next: Patching, Regulation, and User Awareness

DJI has released system updates to address the immediate vulnerability, but ongoing monitoring and further security enhancements are crucial. The company will likely need to conduct thorough security audits of its entire IoT product line to identify and mitigate potential weaknesses.

Beyond DJI, this incident may spur increased regulatory scrutiny of IoT security practices. The FCC’s actions regarding DJI drones demonstrate a growing willingness by U.S. Authorities to intervene when national security concerns arise. Future regulations may mandate stricter security standards for IoT devices, including requirements for secure authentication, data encryption, and vulnerability disclosure programs.

user awareness is paramount. Consumers should be mindful of the security implications of connected devices and accept steps to protect their privacy and security, such as regularly updating firmware, using strong passwords, and being cautious about the data they share with IoT devices. The Romo vacuum incident is a cautionary tale, demonstrating that even seemingly innocuous devices can pose security risks if not properly secured.