Roborock S8 MaxV Ultra
From Wiki-IoT
| Roborock S8 MaxV Ultra | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Roborock S8 MaxV Ultra
Brand: Roborock Category: Robot Vacuum • Model / Gen: 8 S8 MaxV Ultra Release Date: 2024-04-01 • Status: In sale Classification Date: 2026-10-26 • [global.roborock.com/ Official Website] | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No public mass physical-tampering campaign; research focuses on remote/cloud attack paths. |
| Known vulnerabilities | Very common | 🔗 Proof | Check Point Research disclosed remotely-triggerable remote code execution affecting Roborock vacuums in the Xiaomi ecosystem: full remote control, camera feed access and exfiltration of LiDAR floor plans. Xiaomi paid a $30,000 bounty and patched via OTA before public disclosure. |
| Prior attacks | Rare | 🔗 Proof | No known mass exploitation; the RCE was patched before public disclosure. |
| Updatability | Very common | 🔗 Proof | Regular OTA firmware updates through the Roborock/Xiaomi Home app. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | 🔗 Proof | Bound to a Roborock/Xiaomi account; integrations (Alexa, Google Assistant, HomeKit via Matter) brokered through the cloud account. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Cloud and app traffic use TLS; local control over encrypted channels. |
| Storage | Encrypted with up-to-date encryption | 🔗 Proof | Maps and footage stored in the cloud with vendor-managed encryption. |
| Category Score | Score: 1 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Cloud account with multiple users and shared-device permissions. |
| Authentication | Basic | 🔗 Proof | Check Point found the RCE was enabled by flaws in authentication and API security, downgrading the effective auth strength. |
| Brute-force protection | Basic | 🔗 Proof | Cloud-side rate limiting exists but no detailed local lockout policy is documented. |
| Event logging | Partial logging | 🔗 Proof | App shows cleaning/device history; authentication and configuration changes are not exposed as a user-facing audit trail. |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | Xiaomi/Roborock account passwords require complexity; no default device password. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Roborock embedded Linux (Companion App: Roborock App / Xiaomi Home App) |
| Hardware (CPU / GPU) | CPU: Not publicly specified (ARM SoC) • GPU: N/A |
| Memory & Storage | Memory: Not publicly specified • Storage: Not publicly specified |
| Power, Battery & Charging | Battery: 5200 mAh Li-ion • Power: Rechargeable battery • Charging: Auto-return charging dock |
| Display & Camera | Display: N/A • Camera: RGB camera (obstacle recognition) |
| Sound & Connectivity | Sound: Speaker and microphone (voice assistant) • Connectivity: Wi-Fi 2.4/5 GHz, Bluetooth |
| Physical (Dimensions & Mass) | Dimensions: Approx. 350 x 353 x 103 mm • Mass: Approx. 4.5 kg |
