(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| IRobot Roomba j7 (j7550)
|
|
Security Grade
Calculator v
|
iRobot Roomba j7 Wi-Fi Connected Robot Vacuum
Release Date: 2021-09-09 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The robot is a sealed consumer unit with an on-board camera; physical disassembly is required to reach internal storage. Rare is an exposure judgment.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
No iRobot-specific CVE was identified in NVD for the j7 platform; the vendor publishes a remote security-update commitment. Peer robot-vacuum vendors (e.g. ECOVACS) have had CVEs, not iRobot.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
The documented December 2022 incident was a data-handling/privacy disclosure (development-roomba images shared by contractors), not a remote compromise of a shipping j7.
|
| Updatability
|
Very common
|
🔗 Proof
|
Automatic over-the-air security updates are promised for at least five years from release (to 2026-09-09) and the device is still flagged as receiving critical updates.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The robot and app authenticate to iRobot's cloud under a user account and integrate with voice/third-party platforms; no mutual cryptographic device-to-device authentication is documented.
|
| Communications
|
No encryption
|
🔗 Proof
|
Vendor states multiple layers of protection for robot/cloud/app traffic, but no separate locally-encrypted control channel beyond TLS cloud is documented for the assessed profile.
|
| Storage
|
No encryption
|
🔗 Proof
|
Mission/map data is held on internal flash and also synced to iRobot's cloud; the vendor documents no on-robot flash encryption feature.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The device is managed through a single iRobot Home account bound to the robot; no rich local multi-user/role administration is documented.
|
| Authentication
|
Basic
|
🔗 Proof
|
App access is password-based iRobot account sign-in; no mandatory second factor is documented for the assessed profile.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Account-based cloud access relies on the provider's login controls; no device-local failed-login lockout policy is published.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app surfaces cleaning/map history and robot state, but no detailed administrative access/login audit log is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
There is no shared default device password; onboarding creates the user's own iRobot account credentials. No published enforced complexity policy is cited.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
iRobot OS (launched as Genius 3.0); assessment: current OTA build (Companion App: iRobot Home app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: Not officially disclosed by iRobot • GPU:
|
| Memory & Storage
|
Memory: Not officially disclosed by iRobot • Storage: Internal flash for mission/map data; Imprint Smart Maps also stored in the cloud
|
| Power, Battery & Charging
|
Battery: Lithium-ion rechargeable battery • Power: Rechargeable battery charged from the Home Base / charging dock • Charging: Automatic recharge on Home Base / Clean Base dock
|
| Display & Camera
|
Display: Physical clean/home buttons and status LEDs (no screen) • Camera: Front-facing PrecisionVision camera (visual navigation and object avoidance)
|
| Sound & Connectivity
|
Sound: Status tones / beeps • Connectivity: Wi-Fi (2.4 GHz 802.11 b/g/n); managed via iRobot Home app and cloud
|
| Physical (Dimensions & Mass)
|
Dimensions: 33.8 cm diameter × 8.6 cm high • Mass: 3.4 kg
|
Documentation-based security assessment: iRobot Roomba j7 (model j7550) Wi-Fi connected robot vacuum. Reviewed 2026-10-24.
2
3
Documentation-based assessment of a defined Roomba j7 profile paired through the iRobot Home app under a user's iRobot cloud account. Initial onboarding creates the user's own account credentials; there is no shared default device password. The on-board PrecisionVision front-facing camera supports visual navigation and object avoidance. Imprint Smart Maps are stored in the cloud and synced one-to-one to the robot. Firmware and critical security updates are delivered automatically over-the-air, with a documented minimum five-year support window from release. The robot runs on a rechargeable lithium-ion battery docked on its charging base. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.
4
5
Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform/category-level history; the December 2022 incident involved pre-release development robots and contractor data handling, not a remote compromise of a shipping j7. Cloud TLS-protected traffic with no separately documented local encrypted control channel is rated Partial communications. On-robot internal flash holding map/mission data with no documented encryption feature is rated No encryption. Optional capabilities are not treated as enabled unless the assessment configuration states so.
6
7
Release-date scope: 2021-09-09, the date stated in the body of the official iRobot launch press release (and corroborated by iRobot's own security-update support table, which lists Roomba j7 release date as 9/9/2021). Not asserted to be the earliest worldwide retail date.
8
9
Historical vulnerability: no iRobot-specific CVE was identified for the j7 platform in NVD; iRobot commits to remote patching of critical issues. For category context only, peer robot-vacuum vendors have published cloud/video-access CVEs (e.g. CVE-2024-52327, ECOVACS cloud PIN bypass for live video), which are not iRobot issues. The December 2022 MIT Technology Review reporting on Roomba development images shared by contractors is a data-handling privacy incident, not a disclosed software CVE.
10
11
No physical device was tested. Keep the configuration and evidence scope with the ratings.
12
13
References:
14
iRobot Roomba j7 launch press release (2021-09-09)
15
Security updates for Roomba j7 and j7+
16
Camera, PrecisionVision and Obstacle Image Review
17
Imprint Smart Maps: data privacy
18
Roomba j7+ official specifications page
19
Roomba j7 official regional specifications
20
iRobot robot weights (j7 series 3.4 kg)
21
iRobot OS announcement
22
iRobot privacy and security commitment press release
23
NVD CVE-2024-52327 (peer robot-vacuum cloud, category context)
24
Robot-vacuum privacy evidence review (citing MIT Technology Review, Dec 2022)
25
WikiIoT methodology
