IRobot Roomba j9+ (J955020)

Security Grade

Calculator v1

   Brand: iRobot (Parent: iRobot Corporation)

   Category: Robot vacuum with self-emptying base • Model / Gen:  J955020

   Release Date: 2022-09-01 • Status: In sale

   Classification Date: 2026-10-26 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	The bumper and top plate unclip with a spudger and the mainboard carries an exposed serial header, which is how the rooting work on Roomba boards was done.
Known vulnerabilities	Rare	🔗 Proof	No CVE is filed against the j9+ itself; the record is model-independent research on Roomba firmware and map data rather than a published exploit for this unit.
Prior attacks	Rare	🔗 Proof	Researchers have shown floor-plan extraction from Roomba telemetry, but no campaign, no KEV entry and no confirmed in-the-wild compromise of a j9+.
Updatability	Very common	🔗 Proof	iRobot pushes robot and base firmware over the air through the Home app and applies it automatically, with the version listed in the app.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The robot trusts the account it was paired to and accepts commands only through the cloud relay; there is no local authentication surface and no way to give a cleaner a scoped credential.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud traffic is TLS and the robot keeps a persistent MQTT session, but the setup BLE channel is unauthenticated and iRobot does not publish cipher details for the local link.
Storage	No encryption	🔗 Proof	The floor plan and schedule live in internal flash unencrypted, and the map is also uploaded to the account, which is the data that made the mapping research notable.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	A single iRobot account controls every robot on the property, with sharing to household members but no administrator or read-only role.
Authentication	Basic	🔗 Proof	Account login is email and password; no second factor is offered, and the robot itself has no per-user authentication.
Brute-force protection	Basic	🔗 Proof	The account service slows repeated failures but does not lock the account, and the robot exposes no login endpoint that could be rate-limited locally.
Event logging	Partial logging	🔗 Proof	Mission history and error reports are visible in the app, but there is no authentication log and no syslog export.
Passwords	Require change after setup	🔗 Proof	Password change is supported and a minimum length applies, but complexity is not enforced and there is no rotation or expiry.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	iRobot OS (Linux-based) (Companion App: iRobot Home)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4 GHz, Bluetooth LE (setup only)
Physical (Dimensions & Mass)	Dimensions: 340 x 340 x 87 mm (robot) • Mass: 3.4 kg (robot)