Yes—multiple reports were genuine. In May 2024, owners in several U.S. locations said attackers remotely controlled ECOVACS DEEBOT X2-series robot vacuums, accessed or attempted to access their cameras, and broadcast racist abuse through the machines’ speakers. But this was not evidence that every robot vacuum—or every ECOVACS product—had been compromised. The exact attack method was not conclusively established for each incident.
The episode matters because these devices are connected computers with cameras, microphones, speakers, mobile apps and cloud accounts—not simply automated cleaners.
As an Amazon Associate I earn from qualifying purchases.
What happened to the affected owners?
ABC News Australia reported several incidents occurring over several days in May 2024:
- A Minnesota owner said a stranger accessed the vacuum’s live camera and remote-control functions before using its speaker for racist abuse.
- In the Los Angeles area, an owner reported that a remotely controlled vacuum chased a dog.
- An El Paso owner reported similar verbal harassment.
Owners described unexpected movement and sounds, and at least one said that changing the account password and rebooting the vacuum did not immediately stop the activity. Some victims unplugged or retired their machines.
#1 Best Overall
- POWERFUL CLEANING YOU CAN SEE—AND FEEL. The Roomba 105X devours dirt with 70X more power‑lifting suction* to pull embedded dust, crumbs, and pet hair from carpets and hard floors. .*Compared to Roomba 600 series robots.
- 3‑STAGE CLEANING SYSTEM. Combines intense suction, a Multi‑Surface brush, and an Edge‑Sweeping brush to leave floors truly barefoot‑clean—not just surface tidy.
- SMART LIDAR MAPPING = NO MISSED ROOMS. ClearView LiDAR maps your home quickly and cleans in neat, efficient rows, delivering consistent coverage instead of random paths.
- CONFIDENT CLEANING, DAY OR NIGHT. Avoids furniture, cords, and everyday obstacles—even in low light—so cleaning continues smoothly without getting stuck.
- CUSTOM ROOM‑BY‑ROOM CLEANING. Schedule cleans, target high‑traffic areas, adjust suction, and add extra passes where messes build up.
ABC also conducted a controlled demonstration showing serious security weaknesses in the DEEBOT X2, including remote camera viewing. The total number of affected devices remains unknown, so the evidence does not support describing this as a nationwide compromise of all robot vacuums.
Which robot vacuums were involved?
The reports centered on the ECOVACS DEEBOT X2 series, including coverage of the X2 OMNI and X2S variants. The evidence does not establish that Roomba, Roborock or robot vacuums generally were involved in the same incidents.
The X2 combines several systems that create a meaningful security and privacy surface:
- A camera for navigation and live viewing
- Microphone-enabled features
- A speaker that can broadcast audio
- Wireless communications and app-based remote control
- An ECOVACS account and cloud-connected services
That combination means a security failure can affect more than cleaning schedules. It can potentially expose movement controls and sensors that see or hear inside a home.
What security weaknesses were documented?
The real-world takeovers and the later vulnerability disclosures should not be treated as one proven attack chain. Researchers and ECOVACS documented several different weaknesses.
Rank #2
- UP TO 75 DAYS HANDS-FREE CLEANING. Dirt and dust stay gone because it empties into the AutoEmpty dock with a bag that traps 99% of allergens as small as 0.7 microns- That means no mess or cloud of dust when you empty it- Just drop the used bag into the trash and put a new one in the base.
- DEVOURS DIRT WITH 70X MORE POWER-LIFTING SUCTION. 3-Stage Cleaning includes 70X more power-lifting suction*, a Multi-Surface brush, and Edge-Sweeping brush to devour dirt and dust bunnies and leave floors barefoot clean *As compared to Roomba 600 series robots
- SUPER-SMART MAPPING AND NAVIGATION. ClearView LiDAR quickly maps your home to maximize coverage and provide a precise clean while steering smoothly around obstacles and specialized sensors prevent falling down stairs.
- FULLY CUSTOM & TARGETED CLEANING. Schedule and target rooms based on your daily routine and adjust the number of cleaning passes and levels of suction power.
- EASY-TO-USE ROOMBA HOME APP. Simply tap to set a custom clean, get time estimates, check on the filter life, or create keep-out zones to avoid specific areas.
Insufficient PIN validation
The live-camera and remote-control features used a four-digit PIN that was not adequately enforced by the client, server or robot. ECOVACS later described this as an insufficient PIN-validation vulnerability involving client-side authentication. Its advisory says the server-side issue was addressed in ECOVACS HOME app version 3.0.2 and later. See the official video-PIN advisory.
Bluetooth remote-code execution
In a November 19, 2024 advisory, ECOVACS described a Bluetooth remote-code-execution vulnerability affecting selected DEEBOT products. Under specific technical conditions, successful exploitation could compromise an affected device.
Free tools Windows power users keep installed
One-click scans. No signup required.
The advisory lists these patched firmware versions:
| Product | Patched version |
|---|---|
| X2 OMNI | 1.76.6 |
| X2 COMBO | 1.81.10 |
| X2S | 1.49.0 |
| X5 PRO | 1.70.0 |
| X5 PRO PLUS | 1.38.0 |
| X5 PRO ULTRA | 1.17.0 |
| T30 OMNI | 1.93.0 |
| T30S | 1.95.0 |
However, ABC reported that exploiting the Bluetooth weakness required proximity, making it an unlikely single explanation for incidents reported in widely separated U.S. cities. There is no public proof that this flaw caused the May 2024 takeovers.
Missing TLS certificate validation
ECOVACS also disclosed that certain vacuum and lawn-mower app plugins ignored TLS certificate validation. The company said the app issue was addressed in ECOVACS HOME version 3.0.0 and later, with firmware fixes listed for affected models. This is part of the broader security picture, not confirmed proof of the slur-related attacks. Details are in the official TLS advisory.
Rank #3
- A DEEPER CLEAN—EVEN WHERE DIRT LOVES TO HIDE. With advanced DualClean Mop Pads and PerfectEdge technology the Roomba Plus 505X reaches deeper into corners and along walls, covering 18% more floor area* so spills, crumbs, and sticky spots don’t get left behind. * Compared to standard vacuum & mop mode on coffee and grime.
- THE DOCK THAT HANDLES THE DIRTY WORK. The AutoWash Dock empties debris for up to 75 days and washes, refreshes, and heat‑dries mop pads—so you enjoy up to 4 weeks of hands‑free mopping* with consistently fresh results.
- POWERFUL ENOUGH FOR REAL‑LIFE MESSES. From scattered cereal to muddy pawprints, enjoy confident cleaning with up to 70× stronger suction* paired with dual mop pads, a multi‑surface rubber brush, and edge‑sweeping brush. * As compared to Roomba 600 series robots.
- AVOIDS CORDS, SOCKS—EVEN PET ACCIDENTS. PrecisionVision AI instantly recognizes common household obstacles and steers around them. It also detects wet and dry messes ahead and automatically makes extra passes for a noticeably cleaner result.
- SMARTER NAVIGATION, FEWER WORRIES. ClearView Pro LiDAR maps your home precisely and cleans efficiently day or night, while built‑in cliff sensors help prevent falls near stairs and ledges.
ECOVACS published another DEEBOT advisory on May 8, 2025, updated July 1, 2025, covering base-station communication flaws and CVE-2025-30198 through CVE-2025-30200. Later advisories are a reminder that one update should not be treated as a permanent security guarantee.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Did ECOVACS suffer a data breach?
ECOVACS told at least one customer that an unauthorized person had obtained the account and password, and suggested credential stuffing—the reuse of credentials stolen from another service—as a likely explanation. The company said it found no evidence that usernames and passwords came from a breach of ECOVACS systems and said it blocked an associated IP address.
That explanation is different from a confirmed vendor database breach. It also does not resolve the entire question: a stolen password, an app flaw, a device vulnerability and a cloud-service breach are separate possibilities. Public reporting does not prove which method was used in every case.
Could attackers watch or listen inside the home?
Remote camera access was technically possible under the documented flaws. ABC demonstrated live viewing and reported that the camera warning sound could allegedly be disabled remotely. ECOVACS’s PIN advisory confirms that live-video access was affected by insufficient authentication controls.
This supports a serious surveillance risk, but it does not prove that every attacker recorded, stored or distributed footage. It also does not establish that an attacker automatically gained access to the rest of a household’s Wi-Fi network. The strongest conclusion is narrower: a compromised account or vulnerable device could expose camera, microphone, speaker and movement functions.
Rank #4
- UP TO 75 DAYS HANDS-FREE CLEANING. Dirt and dust stay gone because it empties into the AutoEmpty dock with a bag that traps 99% of allergens as small as 0.7 microns. That means no mess or cloud of dust when you empty it. Just drop the used bag into the trash and put a new one in the base.
- DEVOURS DIRT WITH 70X MORE POWER-LIFTING SUCTION. Find, reach and eliminate messes with the combined power of 70X more suction*, multi-surface brush, 20% better edge and corner cleaning with an edge-sweeping brush, to devour dirt and dust bunnies, plus a microfiber mop pad to leave floors shiny.
- SUPER-SMART MAPPING AND NAVIGATION. ClearView LiDAR quickly maps your home to maximize coverage and provide a precise clean while steering smoothly around obstacles and specialized sensors prevent falling down stairs.
- RUGS STAY DRY WHILE MOPPING. Unlike other cleaning robots, the Roomba 105 Combo Robot automatically detects and avoids carpets while mopping so your rugs stay dry – no complex programming required.
- FULLY CUSTOM CLEANING. Choose from settings including vac only, mop only, or combo vac-mop. Schedule and target rooms based on your daily routine and adjust the number of cleaning passes, levels of suction power, and amount of mopping solution pumped onto the microfiber mopping pad.
What DEEBOT owners should do now
- Unplug the vacuum if it moves without authorization, speaks unexpectedly or shows unexplained camera activity.
- Change the ECOVACS account password to a strong, unique password.
- Change passwords anywhere the old ECOVACS password was reused.
- Enable multifactor authentication if the current ECOVACS account and app offer it. Labels and availability may vary by region and app version.
- Update the ECOVACS HOME app through the official Apple App Store or Google Play.
- Install the latest firmware offered for your exact model and region. Updating the app alone may not update the robot.
- Review account sessions, linked devices and household members; remove anything unfamiliar.
- Disable camera, microphone and remote-view functions when they are not needed.
- If unauthorized activity continues, factory-reset the vacuum. This may erase maps, schedules and settings, and does not by itself prove that cloud-side access has been revoked.
- Contact ECOVACS support with the model, firmware version, dates, screenshots and any video evidence.
- Report stalking, threats or suspected privacy invasion to local law enforcement or the FBI.
- Do not try to reproduce a vulnerability against another person’s device.
ECOVACS’s vulnerability-reporting page asks for the product model, software version, observed behavior and numbered reproduction steps or video where appropriate.
Network precautions for smart-home owners
Technically capable households can place smart-home devices on a separate IoT or guest network, keep the router’s firmware current, and disable unnecessary router remote administration and UPnP. Network isolation can limit exposure to other devices, but it cannot repair a vulnerable cloud account or vendor service. It may also disrupt maps, scheduling, notifications, voice assistants or remote control.
What to check before buying a connected vacuum
Security deserves the same attention as navigation and suction performance. Check whether the product:
- Has a camera or microphone, and whether each can be physically covered or disabled
- Supports local operation without a cloud account
- Offers multifactor authentication
- Publishes security advisories and supported firmware versions
- States how long security updates will continue
- Provides a vulnerability-reporting channel
- Lets owners delete maps, images, voice data and cloud history
- Disables remote control by default or provides clear controls
- Continues basic cleaning when cloud access is blocked
- Has an easy physical way to disconnect power
No brand should be described as hack-proof solely because it has avoided a similar headline. Camera and microphone controls, cloud dependence, update support and account security are more useful comparison points.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
What remains unknown
- The precise attack method used in each May 2024 incident
- The total number of compromised devices
- Whether attackers recorded, stored or shared camera or microphone data
- Whether any attacker retained access after owners took remedial steps
- Whether other ECOVACS models were targeted in the same campaign
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
