24.02.2026 18:00
A software engineer who developed an application to control the robot vacuum produced by the Chinese civil drone manufacturer DJI with a game controller unintentionally gained access to the audio and camera footage of thousands of users worldwide, along with their IP addresses and approximate location information due to a security vulnerability.
Software engineer Sammy Azdoufal developed an application to control his newly purchased robot vacuum cleaner with a game controller through an artificial intelligence coding assistant.
UNINTENTIONALLY GAINED ACCESS TO AROUND 7,000 VACUUMS FROM 24 COUNTRIES
Azdoufal, who examined how the robot produced by the Chinese civil drone manufacturer DJI communicated with the company's servers, unintentionally gained access to around 7,000 vacuums from 24 countries due to an authorization vulnerability in the system during the connection.
After discovering that the access key he obtained from the company's servers for his device also provided access to the data of all other users, Azdoufal determined that the device's security code could be completely bypassed and that the camera could be accessed even without pairing.
CAMERA AND AUDIO RECORDINGS, LOCATION INFORMATION...
Azdoufal, who claims he did not illegally enter any system, saw that he could access real-time camera and audio recordings, serial numbers, battery statuses, detailed floor plans of the houses they were used in, and approximate location information through IP addresses of the connected devices.
The incident has brought the issue of data security and personal privacy in camera-equipped and microphone-enabled robot vacuums back to the forefront. Experts have pointed out that without adequate security measures, such devices could pose serious privacy risks.
THE COMPANY STATED THAT THE SECURITY VULNERABILITY HAS BEEN ADDRESSED
In a statement made by a DJI spokesperson following the incident, it was acknowledged that there was a "backend authorization verification issue" in the robot vacuums.
The statement noted that the security vulnerability identified at the end of January was addressed with two updates made on February 8 and 10, and that the adjustment was applied automatically without requiring users to take additional action.
It was stated in the announcement that the vulnerability affected MQTT-based device-server communication and could theoretically lead to unauthorized access, and it was argued that the majority of the identified cases stemmed from tests conducted by security researchers on their own devices.