Roborock Q7 Max (Q380RR)
From Wiki-IoT
| Roborock Q7 Max (Q380RR) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Roborock Q7 Max
Brand: Roborock (Parent: Beijing Roborock Technology Co., Ltd. (no parent; Xiaomi is an early investor)) Category: Vacuum Robot • Model / Gen: Q7 series (first Q-series generation) Q7M52-04 (Japan); Q7M52-00 (EU); Q380RR (regulatory) Release Date: 2022-05-01 • Status: End of sale Classification Date: 2026-10-25 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | https://my.roborock.com/pages/roborock-trust-center 🔗 Proof | Giese 2023 research shows firmware extraction and fault injection on Roborock/Xiaomi vacuums; no Q7 Max-specific public tool. Vendor cites secure boot and tamper-resistant certificates. |
| Known vulnerabilities | Rare | https://global.roborock.com/pages/disclosure-security-vulnerability-on-tuya-iot-cloud https://us.roborock.com/pages/roborock-vulnerability-disclosure-policy 🔗 Proof | NVD keyword search returns 0 Roborock CVEs. The 2021 Tuya-cloud RNG advisory covers S4/S5/S6, not Q7 Max. No Q7 Max CVE found; residual risk cannot be excluded. |
| Prior attacks | None | https://global.roborock.com/pages/disclosure-security-vulnerability-on-tuya-iot-cloud 🔗 Proof | No Roborock entry in CISA KEV; no public in-the-wild Q7 Max campaign found. The 2021 Tuya issue was disclosed and patched, with no exploitation report. |
| Updatability | Very common | https://jp.roborock.com/pages/support-roborock-q7maxapp 🔗 Proof | Firmware updates are delivered via the Roborock app; official support documents the update steps. This is a standard OTA model available to users. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | https://support.roborock.com/hc/en-us/article_attachments/48578428144409 🔗 Proof | Pairs through Roborock/Mi Home accounts and supports Alexa/Google Home via cloud account linking; no open local API, so third-party access needs account authorization. |
| Communications | Encrypted with up-to-date encryption | https://global.roborock.com/pages/privacy-policy 🔗 Proof | Vendor Trust Center states robot-to-app/cloud traffic uses TLS with certificate verification against MITM. Specific TLS version is not published. |
| Storage | Encrypted with up-to-date encryption | https://global.roborock.com/pages/privacy-policy 🔗 Proof | Trust Center states encrypted storage for sensitive data/photos. Q7 Max has no camera and model-specific map-at-rest encryption is not separately documented, so this is partly inferred. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | https://garden-support.roborock.com/hc/pt/articles/15315075773839-Z1-Como-definir-a-senha-da-conta-Roborock 🔗 Proof | Account creation, deletion, password setting and device sharing exist, but no account-level MFA/2FA is offered; management features are basic. |
| Authentication | Basic | https://garden-support.roborock.com/hc/pt/articles/15315075773839-Z1-Como-definir-a-senha-da-conta-Roborock 🔗 Proof | Login uses email/SMS verification code or an optional user-set password; no second factor. Codes expire after 15 minutes. |
| Brute-force protection | Basic | 🔗 Proof | Verification codes are limited to 3 requests per minute and 20 per day per account; this is rate limiting, and no account lockout policy was found. |
| Event logging | Partial logging | 🔗 Proof | App exposes cleaning history, battery and consumable status only; no login, pairing or permission-change audit log is documented. |
| Passwords | Require change after setup | 🔗 Proof | No default device password; setup uses email/SMS OTP and an optional password requiring letters and numbers. No forced rotation or MFA is documented. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary embedded firmware (Companion App: Roborock app (also Mi Home)) |
| Hardware (CPU / GPU) | CPU: N/A • GPU: N/A |
| Memory & Storage | Memory: N/A • Storage: N/A |
| Power, Battery & Charging | Battery: 14.4 V, 5200 mAh Li-ion; up to 180 min • Power: 20 VDC 1.2 A input; dock 100-240 VAC, 28 W • Charging: CDZ11RR/CDZ12RR dock; approx. 6 h |
| Display & Camera | Display: Status LED and buttons; no screen • Camera: None (LiDAR navigation) |
| Sound & Connectivity | Sound: Voice prompts/alerts • Connectivity: Wi-Fi 2.4 GHz only; no Bluetooth |
| Physical (Dimensions & Mass) | Dimensions: 353 x 350 x 96.5 mm (robot) • Mass: 3.7 kg (robot, approx.) |
Student assignment submission for IoT security assessment.
