Roborock S7 MaxV Ultra (Q150RR)

Roborock S7 MaxV Ultra (Q150RR)
Security Grade B Calculator v	Roborock S7 MaxV Ultra (Q150RR) Brand: Roborock Category: Robot vacuum • Model / Gen: Q150RR Release Date: 2022-01-01 • Status: In sale Classification Date:

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	—	Documented physical access via the 'dustbin' debug/UART port (Dennis Giese's research).
Known vulnerabilities	Rare	—	No public CVE, but research documents weak cloud/API trust and static keys in older models. Source: dontvacuum.me/talks/DEFCON29/DEFCON29-vacuum-robots.pdf
Prior attacks	None	—	No known botnet or mass compromise of Roborock devices. Source: infocon.org/cons/DEF%20CON/DEF%20CON%2031/presentations/
Updatability	Very common	—	Frequent automatic firmware and app updates. Source: dontvacuum.me/
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	Cloud/app account and API tokens gate control; device pairing is app-mediated.
Communications	Encrypted with obselete encryption	—	Cloud traffic is encrypted but its content/behavior is opaque; older sound packages used a static password. Source: dontvacuum.me/talks/DEFCON29/DEFCON29-vacuum-robots.pdf
Storage	Encrypted with obselete encryption	—	Newer models add LUKS/TrustZone, but encryption coverage is partial.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Account management	Basic	—	App account with basic family sharing; limited role separation.
Authentication	Basic	—	App login plus optional PIN; API authentication historically weak.
Brute-force protection	Basic	—	Cloud/app login has rate-limiting and optional 2FA.
Event logging	Partial logging	—	App logs cleaning history, not security events.
Passwords	Require change after setup	—	App account password required, but no strong device-level password policy.
Category Score	Score: 2 / 3