Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUpdate: DJI says the ROMO vulnerability has been remediated and that its investigation found no evidence of user-data misuse. Owners should still update the DJI Home app and ROMO firmware.
A researcher trying to control his own DJI ROMO robot vacuum with a PlayStation controller reportedly gained unauthorized visibility into roughly 6,700 other ROMO devices across 24 countries. The exposure included device telemetry and, under some circumstances, access to sensitive robot functions. This was not reported as a breach of DJI’s corporate network; it was a failure in the way the ROMO ecosystem authenticated and validated cloud requests.
As an Amazon Associate I earn from qualifying purchases.
What happened to DJI ROMO?
Security researcher and software engineer Sammy Azdoufal was reportedly working on a way to drive his own DJI ROMO with a PS5 controller. To do that, he analyzed communications between the vacuum, the DJI Home app, and DJI’s backend services.
During that work, a token or credential obtained from his own device allowed his tools to query or interact with a much broader fleet than intended. According to reporting, he identified approximately 6,700 ROMO devices in 24 countries and observed more than 100,000 device messages during testing.
#1 Best Overall
- 🌪️【𝐔𝐧𝐦𝐚𝐭𝐜𝐡𝐞𝐝 𝟔𝟎𝟎𝟎𝐏𝐚 𝐒𝐮𝐜𝐭𝐢𝐨𝐧 𝐏𝐨𝐰𝐞𝐫】➤Experience a new level of clean with 6000Pa of raw suction power, driven by a 19,500 RPM motor. it captures deep-down dirt, sand, and pet hair with ease. The V-shaped rubber-bristle brush actively resists hair tangles. A floating head glides closely along floors, sealing in suction across every surface. Stop manual cleaning for good. This is powerful, effortless cleaning—automated. Set it and forget it
- 3️⃣[𝐀𝐥𝐥-𝐢𝐧-𝐎𝐧𝐞 𝐒𝐰𝐞𝐞𝐩, 𝐌𝐨𝐩 & 𝐕𝐚𝐜𝐮𝐮𝐦]➤This 3-in-1 robot vacuum seamlessly sweeps, vacuums, and mops your floors in a single pass. Equipped with a large 340ml dustbin and a 270ml water tank, it handles big jobs without frequent stops. Customize your clean with 3 levels of suction power and 3 water flow settings. Effortlessly switch from quiet carpet cleaning to a powerful deep scrub for hard floors. Enjoy ultimate cleaning versatility. It's the complete, hands-free solution for any mess
- ✨[𝟔𝟎 𝐃𝐚𝐲𝐬 𝐇𝐚𝐬𝐬𝐥𝐞-𝐟𝐫𝐞𝐞 𝐒𝐞𝐥𝐟-𝐄𝐦𝐩𝐭𝐲𝐢𝐧𝐠 & 𝐂𝐡𝐚𝐫𝐠𝐢𝐧𝐠 𝐃𝐨𝐜𝐤] ➤Introducing the ultimate hands-free experience. Our 2-in-1 dock automatically empties the robot's dustbin and recharges it after every clean. With a massive 3.5L dustbag, the station can hold up to 60 days of dirt and debris. You can forget about vacuuming and emptying for months at a time. This is true automation. Set your schedule and let the robot handle the rest, effortlessly maintaining a spotless home day after day
- 🧭[𝟑𝟔𝟎° 𝐒𝐦𝐚𝐫𝐭 𝐋𝐚𝐬𝐞𝐫 𝐍𝐚𝐯𝐢𝐠𝐚𝐭𝐢𝐨𝐧 & 𝐌𝐚𝐩𝐩𝐢𝐧𝐠] ➤Equipped with advanced LiDAR navigation, this robot scans your home to create accurate maps in just 10 minutes. It glides smoothly and avoids obstacles with precision. The system supports up to 5 unique maps, perfect for multi-level homes. Powerful laser technology ensures reliable, efficient cleaning even in complete darkness. Schedule it once and let the robot navigate your home flawlessly day or night, for a consistently spotless clean with no manual intervention
- 📱[𝐅𝐮𝐥𝐥 𝐀𝐩𝐩 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 & 𝐂𝐮𝐬𝐭𝐨𝐦𝐢𝐳𝐚𝐭𝐢𝐨𝐧] ➤Command your robot from anywhere with the Smart Life/Tuya Smart app. Gain total control by customizing the smart map to fit your unique home layout. Effortlessly set no-go zones, virtual walls, and customize suction power and water flow for each individual room. Manage up to 5 different maps for a perfectly tailored clean. This is personalized cleaning automation. Schedule cleanings and adjust settings remotely, ensuring every room is cleaned exactly how you want it
The discovery exposed weaknesses in device identity, authorization boundaries, and backend validation. Azdoufal reportedly did not set out to access other customers’ vacuums or deliberately misuse their data. But the fact that ordinary credentials from one consumer device could provide visibility into other devices made this a serious unauthorized-access vulnerability.
Android Authority reported that the original project began as an attempt to add PlayStation-controller support. TechRadar’s account described the issue as involving the ROMO communications path rather than a conventional intrusion into DJI’s internal corporate systems.
How many vacuums were exposed?
The best-supported reported figure is approximately 6,700 devices across 24 countries. That is the number the researcher said his tooling could identify during testing—not necessarily the total number of ROMO owners who were exposed.
Some headlines and online discussions use figures such as 7,000 or more than 10,000. Those numbers should not be treated as confirmed equivalents. Tom’s Hardware reported the approximately 6,700-device count.
What information could be seen?
Reports described access to or visibility into several categories of ROMO data:
- Device serial numbers and identifiers
- Battery level and cleaning status
- Current tasks and rooms being cleaned
- Approximate location or regional information
- Floor plans, maps, and room information
- Obstacles, travel distance, and other telemetry
- Potentially, control functions
Camera-equipped ROMO models make the consequences more serious. Reporting described live-camera access during testing and said the researcher was able to bypass the expected security PIN on his own unit. That demonstrates the potential impact, but it does not establish that every affected customer’s camera was viewed or that every ROMO model had identical exposure.
It is important to distinguish between different levels of access:
Rank #2
- 𝟳-𝗪𝗲𝗲𝗸𝘀 𝗛𝗮𝗻𝗱𝘀 𝗙𝗿𝗲𝗲 𝗖𝗹𝗲𝗮𝗻𝗶𝗻𝗴: With a 2.7L sealed dust bag, the RockDock Plus efficiently collects pet hair, dirt, and debris without the need for constant emptying. This means longer cleaning cycles and more time between maintenance, ensuring your home stays consistently clean.
- 𝟭𝟬𝟬𝟬𝟬𝗣𝗮 𝗛𝘆𝗽𝗲𝗿𝗙𝗼𝗿𝗰𝗲 𝗦𝘂𝗰𝘁𝗶𝗼𝗻 𝗣𝗼𝘄𝗲𝗿: High-performance suction lifts pet hair and debris from every surface, reaching deep into carpets and along edges for a thorough clean in every pass.
- 𝗗𝘂𝗮𝗹 𝗔𝗻𝘁𝗶-𝗧𝗮𝗻𝗴𝗹𝗲 𝗗𝗲𝘀𝗶𝗴𝗻: Spend less time detangling and more time enjoying your day. The JawScrapers main brush and 0% hair-tangling side brush resist pet hair wrap, even from long-haired breeds. With fewer cleaning interruptions, your robot stays ready with minimal effort.
- 𝗥𝗲𝗺𝗼𝘃𝗲𝘀 𝗗𝘂𝘀𝘁 𝗬𝗼𝘂 𝗛𝗮𝗿𝗱𝗹𝘆 𝗦𝗲𝗲: This advanced system combines vacuuming and mopping in one go, effectively capturing even the finest dust that traditional vacuuming may leave behind. With three adjustable water flow settings, you can tailor the cleaning power to meet your specific needs.
- 𝗣𝗿𝗲𝗰𝗶𝗦𝗲𝗻𝘀𝗲 𝗟𝗶𝗗𝗔𝗥 𝗡𝗮𝘃𝗶𝗴𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺: PreciSense LiDAR maps your home with precision, ensuring efficient and thorough cleaning. Its real-time mapping technology enables optimized cleaning paths, perfect for homes with pets and multiple rooms.
| Capability | What the available evidence supports |
|---|---|
| Device identification | Reportedly observed across thousands of units |
| Status and battery data | Reportedly visible through device messages |
| Location, rooms, and maps | Reported as accessible or exposed; the exact scope varied by device and data type |
| Live video | Demonstrated on the researcher’s own unit; not proven for every device |
| Remote commands | Reported as possible, but not equivalent to unrestricted persistent control of every vacuum |
| Customer-data misuse | DJI says its investigation found no evidence of misuse |
Was DJI hacked?
Not in the usual sense. Available reporting says the researcher did not brute-force passwords, steal customer credentials, or break into DJI’s corporate network. He used his own ROMO and analyzed the credentials and communications available to that device.
The reported problem was instead a backend authentication and authorization failure: the service did not reliably enforce the boundary between the researcher’s device and other customers’ devices. Calling this a security vulnerability is accurate even if the researcher’s characterization was that he had not “hacked” DJI in the conventional sense.
Was anyone harmed?
No confirmed criminal campaign or confirmed misuse of customer data has been established by the available evidence. DJI says its investigation found that the observed activity was primarily connected to security researchers’ testing and found no evidence that user data was misused.
That statement should not be confused with proof that no unauthorized access occurred. The distinction is:
Recommended Free Tools
- Exposure: Data and device functions were reportedly reachable outside their intended authorization boundary.
- Access: The researcher says he observed and tested the issue.
- Misuse: DJI says it found no evidence that customer data was misused.
- Confirmed criminal exploitation: Not established by the available sources.
DJI’s current position is set out in its security response concerning ROMO.
DJI says the vulnerability is fixed
DJI says it identified a backend validation issue in late January, received reports from two independent researchers through its bug-bounty program, deployed updates, and completed remediation. The company says no user action is required and that it found no evidence of user-data misuse.
The company’s statement is the basis for the remediation claim. ROMO’s April 13, 2026 release notes also list security-related changes, including new security-passcode and related protection settings. Those notes support the existence of security improvements, but the release notes alone do not prove the precise technical fix for the reported backend flaw.
Rank #3
- 90-Day Hands-Free Cleaning: The 3L self-emptying dustbag holds weeks of debris, eliminating the need for frequent emptying. Enjoy effortless maintenance with this robot vacuum self-emptying
- 6000Pa Ultra-Strong Suction: The L8000 Plus Robot Vacuum effortlessly lifts debris, pet hair, and deep-seated dirt from floors & carpets. It will automatically increase suction to 6000 Pa(Max) on the carpet
- 360° LiDAR Navigation & Smart Mapping: Equipped with advanced LiDAR technology, the robot vacuum and mop scans your home in 360° and creates maps. It intelligently avoids obstacles like walls, stairs, ensuring no missed spots or repeated passes. Multi-floor maps(5 Max) can also be saved for seamless cleaning
- 2-In-1 Sweeping & Mopping: Sweepping, Mopping and Self-emptying in one device. Customize cleaning with 3 suction levels & 3 water flow settings for all floor types（In mop mode, please remove the mop holder or establish a no-go zone to prevent the vacuum from dirtying your carpet）
- Convenient App & Voice Control: You can customize no-go zones and no-mop zones, set up virtual walls, schedule cleaning, select specific rooms or areas to clean, and adjust the water level and suction power according to your individual cleaning requirements. This makes smart home cleaning a breeze. It can also work with Alexa, supports 2.4Ghz & 5Ghz WI-FI
The relevant release notes identify:
- ROMO firmware: V01.00.15.00
- DJI Home app: V1.5.16 for iOS and Android
- Release date: April 13, 2026
What ROMO owners should do now
DJI says no action is required because the server-side remediation has been deployed. Updating remains sensible, especially because the later app and firmware release notes include security protections.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Update DJI Home through the official Apple App Store or Google Play Store.
- Open the ROMO in DJI Home and go to Device Settings → Firmware Update.
- Install the latest firmware offered for your specific ROMO model. The April 2026 notes identify V01.00.15.00 as a relevant version.
- Enable automatic updates if that option is available. The ROMO manual documents the update path and automatic-update setting.
- Review and reset security-passcode or device-access settings introduced by the update.
- Change your DJI account password if you reused it on another service.
- Revoke unfamiliar sessions or connected accounts if DJI Home provides those controls.
Do not factory-reset the vacuum as a universal remedy. A reset can erase maps, schedules, and preferences without addressing a server-side vulnerability. If the update fails, keep the robot on its charging base, ensure the app and vacuum have network access, retry through DJI Home, and contact DJI Support. Avoid unofficial firmware packages or reverse-engineered tools.
What “fixed” does—and does not—mean
“Fixed” means DJI reports that this specific remediation is complete. It does not prove that ROMO has no other vulnerabilities or that the product is permanently secure.
DJI says it plans independent third-party security audits and additional certifications for ROMO and DJI Home. The company also lists ROMO credentials including ETSI EN 303 645, EU RED/EN 18031, and UL Solutions Diamond IoT security certifications. Those are useful indicators of security work, but no certification guarantees immunity from future or previously undiscovered flaws. Security is an ongoing requirement for any cloud-connected device.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why robot vacuums are privacy-sensitive
A connected robot vacuum can be much more than a cleaning appliance. Depending on the model, it may have a detailed map of the home, room names, cleaning schedules, cameras, microphones or voice-control integration, Wi-Fi and cloud-account associations, and remote-control features.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Even without a camera, a map can reveal bedrooms, entrances, hallways, and the layout of a workplace. Cleaning schedules and telemetry may also reveal routines or whether a property is occupied. A camera-equipped model adds visual information to that profile.
That is why the relevant security question is not simply whether someone could start the vacuum remotely. The more important questions are whether cloud services enforce per-device authorization, whether credentials are bound to individual hardware, what data leaves the home, and how quickly the manufacturer can respond when a flaw is found.
Rank #4
- UP TO 75 DAYS HANDS-FREE CLEANING. Dirt and dust stay gone because it empties into the AutoEmpty dock with a bag that traps 99% of allergens as small as 0.7 microns- That means no mess or cloud of dust when you empty it- Just drop the used bag into the trash and put a new one in the base.
- DEVOURS DIRT WITH 70X MORE POWER-LIFTING SUCTION. 3-Stage Cleaning includes 70X more power-lifting suction*, a Multi-Surface brush, and Edge-Sweeping brush to devour dirt and dust bunnies and leave floors barefoot clean *As compared to Roomba 600 series robots
- SUPER-SMART MAPPING AND NAVIGATION. ClearView LiDAR quickly maps your home to maximize coverage and provide a precise clean while steering smoothly around obstacles and specialized sensors prevent falling down stairs.
- FULLY CUSTOM & TARGETED CLEANING. Schedule and target rooms based on your daily routine and adjust the number of cleaning passes and levels of suction power.
- EASY-TO-USE ROOMBA HOME APP. Simply tap to set a custom clean, get time estimates, check on the filter life, or create keep-out zones to avoid specific areas.
What buyers should check
Before buying any connected robot vacuum, check the specific model—not just the brand—for:
- Camera and microphone hardware
- Whether maps are stored locally, in the cloud, or both
- Whether remote access is mandatory
- Automatic security updates and published release notes
- A vulnerability-disclosure or bug-bounty program
- Per-device credentials and cloud authorization controls
- Whether core cleaning works without cloud access
- Regional availability, support, and update policies
DJI ROMO is a particularly poor fit for buyers who require fully offline operation or who are uncomfortable with a camera-equipped device in the home. Alternatives such as iRobot, Roborock, eufy, and Dreame must still be evaluated model by model; a different brand is not automatically a privacy solution.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Technically experienced owners may investigate Valetudo, which can remove cloud dependence from some compatible robot vacuums. Compatibility and installation risks vary, and it should not be attempted without confirming the exact model and accepting possible warranty or support consequences.
Does network isolation help?
Putting the vacuum on a separate guest or IoT network is a sensible defensive measure. It can limit access to other devices on the home network if the vacuum is compromised.
It cannot solve a server-side authorization flaw. The vacuum still needs to communicate with the vendor’s cloud service, so a cloud service that accepts an unauthorized command may still be able to reach it. Network isolation reduces local-network risk; it does not replace vendor-side security.
What remains unknown
- The exact total number of affected devices
- Whether every ROMO model had identical exposure
- Whether any non-researcher accessed customer data
- The precise technical root cause, unless DJI or the researcher publishes more detail
- Whether the remediation has received independent public validation
Those limits matter because dramatic headlines can blur the difference between device enumeration, telemetry access, map access, camera viewing, issuing commands, and persistent control.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The responsible-disclosure lesson
Researchers should not reproduce serial-number enumeration methods, API endpoints, tokens, MQTT topics, exploit code, or commands that could probe other customers’ devices. DJI’s vulnerability-reporting guidance says researchers should test only authorized assets, stop after verifying a vulnerability, avoid accessing or exfiltrating genuine user data, and keep details confidential until remediation and authorized disclosure.
The ROMO incident is a reminder that an attack does not need sophisticated malware or a corporate-network breach to become serious. A cloud-connected home device can expose sensitive information when its authentication and authorization boundaries are poorly implemented.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
