DJI Romo and Power Stations Vulnerability Exposed User Data and Control

Youtube

·

Original Report

↗ Youtube

A software engineer discovered a broken access control vulnerability in DJI's Romo robot vacuum and some DJI power stations, identified as a backend permission validation failure, which allowed unauthorized access to devices, live camera feeds, and remote control capabilities for approximately 7,000 DJI Romo robot vacuums across 24 countries and over 10,000 devices including DJI power stations.