Smart home firms warned as DJI Romo bug exposed 7,000 vacuums to unauthorized remote control
A backend permission error allowed one customer to access thousands of devices, highlighting risks in smart home connectivity.
Key points
- One user accidentally controlled approximately 7,000 robot vacuums worldwide due to a server-side flaw.
- DJI issued two updates on February 10, 2026, to resolve the backend permission issue.
- The vulnerability allowed access to other users' devices, not just the attacker's own unit.
A single user accidentally gained control of roughly 7,000 robot vacuums across the globe because of a security flaw in the manufacturer's backend systems. This incident, involving DJI Romo devices, demonstrates how a failure in permission checks can expose thousands of households to unauthorised remote access, turning personal cleaning appliances into potential entry points for broader privacy breaches.
According to Engadget, the user, identified as Sammy Azdoufal, discovered the issue while attempting to remotely operate his own vacuum cleaner. Instead of connecting only to his device, the server recognised him as a legitimate customer but failed to restrict his access to his specific unit. He found himself able to command and view data from thousands of other cleaners instead of just one.
What we know
DJI confirmed that it resolved the specific security risk by issuing two software updates on February 10, 2026. The company stated that the problem was a backend permission error where the server did not properly isolate individual customer devices. Azdoufal used AI tools to help reverse-engineer the communications, but the underlying weakness was in the server's security checks, not the AI itself.
This incident highlights that complex passwords cannot fix fundamental architectural flaws in how servers validate user permissions. The breach was not a result of weak user credentials but rather a failure in the system's logic for separating one user's data from another's.
Defender's checklist
- Verify that all smart home devices are running the latest firmware versions provided by the manufacturer.
- Review privacy settings within the companion app to limit data sharing and remote access capabilities.
- Monitor device activity logs for any unauthorised commands or unexpected movements.
- Disconnect internet connectivity for devices that do not require cloud features for basic operation.
The background in plain language
Smart home devices often rely on cloud servers to process commands and store data. When you send a command from your phone, it travels to the manufacturer's server, which then relays it to the device. Teams usually implement strict permission checks to ensure a user can only control their own hardware. Check whether your devices isolate data correctly, as a failure in this logic can allow one user to access another's equipment.
What to do and how to stay safe: DJI
- Update your robot vacuum software immediately if the vendor has released a patch for this issue.
- Review the privacy policy and data handling practices of your smart home device manufacturer.
- Disable remote access features if you do not need to control the device while away from home.
- Monitor network traffic for unusual connections between your smart devices and external servers.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the user hack the vacuums using a virus?
No, the user exploited a backend permission flaw that allowed him to access other devices without malicious code.
When was the security issue fixed?
DJI issued two updates to resolve the backend permission issue on February 10, 2026.
How many devices were affected?
The user accidentally gained control of approximately 7,000 robot vacuums across the world.
