DJI Romo Security Vulnerability: Robot Vacuum Hack Exposes IoT Risks

What happened to the DJI Romo?

In early February 2026, security researcher Sammy Azdoufal discovered that the DJI Romo robot vacuum could be accessed without authentication through DJI’s cloud‑based MQTT service. By reverse‑engineering the communication protocol, he was able to list, map, and even stream video from more than 7,000 Romo units worldwide. The breach highlighted a classic backend permission validation issue that let any authenticated client subscribe to wildcard topics (e.g., #) and read every device’s telemetry in plaintext.

The incident was reported to DJI, and the company responded with two firmware patches (February 8 and February 10) that closed the permission gap. While the immediate threat has been mitigated, the episode raises broader concerns for IoT security and the safety of smart home ecosystems.

Technical breakdown of the MQTT exploit

MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe protocol widely used in IoT devices for low‑bandwidth communication. DJI’s implementation suffered from three critical flaws:

• Missing topic‑level ACLs: Once a client authenticated with a valid token, it could subscribe to #, receiving every message from every Romo on the broker.
• Insufficient token isolation: The private token extracted from a single Romo was not scoped to that device alone, allowing the same token to query data from any other Romo linked to the same server region.
• Clear‑text telemetry: Although the transport layer used TLS, the payload (serial number, battery level, room map, camera URL) was sent in plaintext, making it readable by any authorized subscriber.

By sending a simple MQTT SUBSCRIBE request to DJI’s US, EU, or China broker, Azdoufal’s script received a continuous stream of JSON messages. Each message contained the robot’s current location, cleaning status, and a URL to the live video feed—bypassing the device’s PIN protection.

Because the MQTT broker is a shared resource for both the Romo vacuum and DJI Power portable stations, the same vulnerability potentially exposed thousands of additional power‑management devices.

How many devices were affected and what DJI did about it

Within nine minutes of launching his scanner, Azdoufal logged 6,700 Romo devices across 24 countries and captured over 100,000 telemetry packets. Adding the Power stations raised the total to roughly 10,000 devices.

DJI’s public statement acknowledged a “backend permission validation issue” and outlined the remediation timeline:

1. Initial patch (Feb 8) – limited the scope of tokens but did not propagate to all service nodes.
2. Follow‑up patch (Feb 10) – re‑enabled and restarted the remaining nodes, fully enforcing topic‑level ACLs.

The patches were delivered automatically via OTA updates; no user action was required. DJI also emphasized that the communication channel remains encrypted with TLS, and that data is stored on AWS US‑based infrastructure.

For a deeper look at DJI’s remediation, see the original Verge story.

Why this matters for the broader IoT ecosystem

The Romo case is a textbook example of how a seemingly minor backend oversight can cascade into a massive privacy breach. Several lessons emerge for manufacturers, developers, and end‑users:

These principles align with best practices promoted by platforms like UBOS platform overview, which offers built‑in security controls for AI‑driven applications.

How to protect your DJI Romo and other smart home devices

Even after a patch, users should adopt a layered security posture. Follow these actionable steps:

1. Verify firmware version: Open the DJI Home app, navigate to Settings → About, and confirm you are running the latest DJI firmware update (released Feb 10, 2026). If not, trigger an OTA update manually.
2. Change default passwords: Although Romo uses token‑based auth, the companion app still stores a PIN. Choose a strong, unique PIN and avoid reusing it across devices.
3. Restrict network exposure: Place the vacuum on a separate VLAN or guest Wi‑Fi network. This limits lateral movement if a device is compromised.
4. Disable unnecessary cloud features: If you don’t need remote mapping, turn off “cloud sync” in the app settings. Fewer data points mean a smaller attack surface.
5. Monitor MQTT traffic: Advanced users can run a local MQTT broker mirror to inspect inbound/outbound topics. Look for unexpected wildcard subscriptions.
6. Leverage AI‑driven security tools: Solutions like the AI SEO Analyzer demonstrate how AI can parse logs and flag anomalies in real time.

For enterprises managing fleets of IoT devices, consider a dedicated security platform such as the Enterprise AI platform by UBOS, which integrates threat detection with automated remediation workflows.

What’s next for DJI and the smart‑home market?

DJI’s rapid patch shows that responsive OTA updates can contain large‑scale vulnerabilities, but the incident also underscores the need for continuous security audits. As more households adopt AI‑enabled appliances, the attack surface will only grow.

Developers building IoT solutions can accelerate secure development by using ready‑made integrations. For example, the ChatGPT and Telegram integration lets you receive real‑time alerts when anomalous device behavior is detected, while the Chroma DB integration offers vector‑based log storage for fast similarity searches.

Startups looking to differentiate on security can leverage the UBOS for startups program, which provides sandbox environments, pre‑built security modules, and access to the UBOS templates for quick start. One template, the AI Article Copywriter, can help you generate clear security documentation for your products.

Finally, if you’re a small‑to‑medium business, the UBOS solutions for SMBs include a Workflow automation studio that can automatically quarantine devices that exhibit suspicious MQTT patterns.

Conclusion

The DJI Romo security vulnerability was a wake‑up call for the entire IoT community. While DJI’s swift firmware update has closed the most critical gap, the episode illustrates how backend permission flaws can expose millions of devices to remote takeover. By applying the principle of least privilege, encrypting payloads, and adopting AI‑enhanced monitoring, both manufacturers and consumers can safeguard their smart homes against similar threats.

Stay informed, keep your devices updated, and consider integrating advanced security platforms like those offered by UBOS homepage. Protecting your connected world starts with a single step—make it a secure one today.