https://www.theverge.com/tech/879088/dji-romo-hack-vulnerability-remote-control-camera-access-mqtt
A Spanish AI strategist accidentally gained unauthorized access to approximately 7,000 DJI Romo robot vacuums worldwide after attempting to create a custom remote control app for his own device using a PlayStation 5 gamepad. Sammy Azdoufal discovered that by simply extracting his own vacuum’s authentication token, DJI’s poorly secured MQTT servers granted him access to thousands of other users’ devices across 24 countries, allowing him to remotely control the robots, view live camera feeds, listen through their microphones, and monitor detailed floor plans of users’ homes. During a live demonstration to The Verge, Azdoufal’s system cataloged 6,700 DJI devices and over 10,000 total products including the company’s portable power stations within nine minutes, with each device transmitting unprotected data packets every three seconds containing serial numbers, cleaning status, location information, and obstacle detection data.
The vulnerability’s severity became apparent when Azdoufal could access The Verge’s review unit using only its 14-digit serial number, correctly identifying that it was cleaning a living room with 80 percent battery remaining and generating an accurate floor plan of the residence from another country. Azdoufal claims he discovered the flaws without traditional hacking methods, instead finding that DJI’s servers lacked proper topic-level access controls on their MQTT broker, meaning any authenticated client could subscribe to wildcard topics and view all device messages in plaintext at the application layer despite TLS encryption protecting the transmission pipe. The researcher also demonstrated the ability to bypass the Romo’s security PIN to view live video feeds, even accessing devices before they were paired with user accounts.
DJI initially claimed it had resolved the vulnerability prior to public disclosure, but Azdoufal demonstrated continued access to thousands of devices hours after receiving that statement from the company. DJI subsequently admitted to a backend permission validation issue and deployed a second patch on February 10 to fully address the problem, stating that the vulnerability created theoretical potential for unauthorized live video access with nearly all identified activity linked to security researchers testing their own devices. However, DJI’s explanation that data is encrypted in transit and stored on US-based AWS servers misses the fundamental issue that anyone with authenticated access inside those servers could read all device data in plaintext. Azdoufal reports that additional vulnerabilities remain unpatched as of mid-February, raising serious questions about whether the Chinese dronemaker can adequately protect connected home devices against malicious actors, particularly given the incident occurred without sophisticated hacking techniques or targeted intrusion attempts.