DJI Romo Robot Vacuum
From Wiki-IoT
Revision as of 14:16, 25 October 2026 by RuiQin (talk | contribs) (DJI Romo's MQTT broker lacked topic-level access control, exposing ~6,700 devices via a single token. Data was stored in plaintext, and camera PIN validation could be bypassed.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| DJI Romo Robot Vacuum | ||
|---|---|---|
|
Security Grade
Calculator v
|
DJI Romo Robot Vacuum
Brand: DJI (Parent: DJI Innovations) Category: Robot Vacuum • Model / Gen: Romo Romo Release Date: 2025-08-06 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper mechanism reported. |
| Known vulnerabilities | Very common | 🔗 Proof | MQTT broker lacked topic-level access control; one token exposed ~6,700 devices. |
| Prior attacks | Rare | 🔗 Proof | Accidental discovery, no confirmed malicious exploitation in the wild. Updatability |
| Updatability | Very common | 🔗 Proof | DJI deployed patches Feb 2026; some vulnerabilities remained unpatched at time of reporting. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | MQTT broker lacked topic-level access control; single token acted as a master key. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | TLS used between device and server, but application-layer data was plaintext. |
| Storage | No encryption | 🔗 Proof | Server-side data stored in plaintext; accessible once authenticated. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Absent | [t https://tech.yahoo.com/cybersecurity/articles/7-000-robot-vacuums-one-101046756.html 🔗 Proof] | No topic-level ACL on MQTT broker; any valid token could access others. Authentication |
| Authentication | Absent | 🔗 Proof | Camera PIN bypass allowed video stream access without authentication. Brute-force protection |
| Brute-force protection | Absent | 🔗 Proof | Not relevant: no brute force needed; single legitimate token sufficed. |
| Event logging | Absent | 🔗 Proof | No evidence of access logging or anomaly detection for cross-device queries. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Camera PIN bypassed via API-level access; PIN validation was client-side only. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Embedded Linux (Companion App: DJI Home App) |
| Hardware (CPU / GPU) | CPU: Unknown (Embedded SoC) • GPU: None |
| Memory & Storage | Memory: Unknown • Storage: Internal Flash |
| Power, Battery & Charging | Battery: Built-in Lithium-ion Battery • Power: Charging Dock • Charging: Auto-recharge via Dock |
| Display & Camera | Display: None • Camera: Built-in Camera (for navigation and live view) |
| Sound & Connectivity | Sound: Built-in Microphone (for voice/audio capture) • Connectivity: Wi-Fi (2.4GHz), Cloud MQTT |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
