A server-side access-control flaw reportedly gave a researcher access to more than 6,700 DJI Romo robot vacuums, including floor plans, live camera feeds and microphone data.
Robot vacuums are increasingly sold as intelligent home devices, but the latest debate around DJI’s Romo line shows how much data they can expose when their security is weak. According to Engadget, a hobbyist attempting to control his own vacuum instead found himself able to reach thousands of Romo devices worldwide, underscoring how a failure in server-side access controls can turn a domestic appliance into a remote privacy risk. TechRadar reported that the flaw affected more than 6,700 devices across several countries.
The problem was not that the vacuum’s communications were left unencrypted. Rather, as SC World noted, the weakness lay in how DJI’s servers handled legitimate users once they had authenticated, allowing access to devices that were not theirs. Tom’s Hardware reported that the researcher had been reverse-engineering the Romo’s communication protocol so he could use a PlayStation controller, but the access token obtained in the process exposed not only remote controls, but also floor plans, live camera feeds and microphone data.
DJI has since said the issue was fixed with two updates released on 10 February 2026. That detail matters because it points to a broader category of risk in connected home products: even when device software appears to work as intended, the cloud systems behind it can still be misconfigured. In this case, the concern was not limited to one enthusiast’s experiment. It exposed a structural weakness in how some manufacturers separate one household’s data from another’s once information is uploaded to their own infrastructure.
That is why privacy questions around robot vacuums extend well beyond a single security flaw. As the lead article notes, some models can collect cleaning histories, room names, floor maps, detected objects and network details, while higher-end devices may also include microphones or remote video functions. In its privacy policy, iRobot says connected models may transmit far more than a simple map of a home, including room names, floor types, detected objects, robot movement and Wi-Fi information. For consumers, the practical issue is not whether these features are useful, but whether they understand exactly what is being collected, where it is stored and who can reach it.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
