A serious cybersecurity vulnerability affecting thousands of robot vacuum cleaners was exposed after a reach strategist inadvertently gained access to more than 7000 devices using a single Sony PlayStation 5 controller. The discovery highlights how gaps in cloud connectivity and access control systems can put connected devices at risk across multiple countries.
The incident began when cybersecurity enthusiast and reach strategist Sammy Azdoufal attempted to build a custom application to control his new DJI Romo robot vacuum using an AI‑assisted coding tool. The goal was to integrate the vacuum control interface with a PS5 controller for personal experimentation and convenience.
However Azdoufal soon noticed unexpected behaviour. Instead of interacting only with his own device the application appeared to connect to a much larger number of vacuums located in different regions. Further investigation revealed that the server responsible for managing communication between individual RJomo devices and the cloud infrastructure lacked topic‑level access controls. This weakness allowed authenticated users to receive traffic streams from any connected device once they held a valid device token.
As a result Azdoufal was able to inadvertently observe data from thousands of robot vacuums in almost 24 countries. The exposed information reportedly included microphone audio onboard camera feeds and live video — features designed as optional user functions for home monitoring and automation. In effect the vulnerability created a situation in which one authenticated session could capture sensitive data from multiple unrelated devices.
Security experts said the root of the problem was the absence of robust authentication boundaries in the cloud system managing the devices. Instead of enforcing strict isolation between individual device connections the platform allowed an authenticated token to subscribe to any device message stream — a flaw that can be exploited once one device is incorrectly trusted as proof of access.
DJI — the manufacturer of the Romo vacuum — has not yet published an official security advisory or patch as of the latest updates. However cybersecurity professionals have urged affected users to take immediate steps to reduce risk. Recommended precautions include isolating robot vacuums on a separate network segment limiting internet exposure through firewalls and disabling remote access features until a fix is issued.
The incident underscores broader concerns about the security of Internet‑of‑Things (IoT) products. As more household devices gain cloud connectivity and remote control features manufacturers are under increasing pressure to enforce strong authentication and data partitioning between user accounts and device streams. Vulnerabilities in these systems can lead not just to loss of privacy but also to broader attacks that compromise networks and personal information.
Experts point out that device makers should implement strict topic or channel level permissions so that authenticated access to one device does not grant visibility into unrelated devices. In addition robust encryption and multi‑factor authentication can help reduce the likelihood of mass exposure when cloud access tokens are compromised.
Azdoufal has shared portions of his discovery with cybersecurity communities to raise awareness of the issue but has urged caution among users who might replicate the experiment. “This wasn’t an intentional hack,” he said in a statement to reporters, “but it showed how quickly access can escalate when proper protections are missing.”
Security researchers and industry analysts are monitoring the situation. Many emphasise that timely patches and updates are critical in an era where billions of connected devices operate on shared cloud infrastructure. Vulnerabilities in one platform can affect users globally and privacy risks can extend far beyond initial design expectations.
