DJI Robot Vacuum Hack: How a PlayStation Controller Exposed 7,000 Homes

The PlayStation Controller That Unlocked 7,000 Homes

It was Valentine’s Day, a day usually reserved for grand gestures and quiet dinners. But for Sammy Azdoufal, it became the day he accidentally realized he could peer into the living rooms of thousands of strangers. Azdoufal wasn’t a high-level cybercriminal working from a dark basement; he was a guy with a PlayStation controller and a DJI Romo robot vacuum. By simply tinkering with his controller setup, he stumbled upon a catastrophic security flaw that granted him access to a network of 7,000 other DJI robots.

As someone who has spent years reviewing the latest gadgets and filling my own home with smart tech, this story hits close to home. It’s one thing to read about a data breach at a social media company. It’s another thing entirely to realize that the little disc-shaped helper you bought to keep your carpets clean could effectively become a roaming surveillance camera for anyone with the right peripheral and a bit of curiosity.

This incident, while bizarre, is a massive wake-up call. DJI, a brand we’ve long praised for its industry-leading drones, has struggled to translate that engineering prowess into bulletproof home security. While they eventually paid Azdoufal a $30,000 bug bounty—a significant step up from their historically defensive stance toward security researchers—the damage to consumer trust is harder to patch than a line of code.

The Romo Identity and the Security Gap

To understand how we got here, we have to look at the device itself. Originally marketed under a few different naming conventions including the RoboVac series, the DJI Romo was intended to be the ultimate smart home companion. It’s sleek, efficient, and carries the prestige of the DJI name. But the Azdoufal hack revealed a chilling reality: convenience often comes at the cost of compromise.

Azdoufal’s discovery allowed him to not only see the status of these devices but potentially access their data streams. DJI was reportedly already working on some of these fixes, but the scale of the vulnerability—7,000 devices open to a guy with a gaming controller—suggests that security was an afterthought in the design process.

This isn't just a DJI problem. It’s a systemic issue in the Internet of Things (IoT) world. We are currently in a gold rush where manufacturers are racing to add Wi-Fi and smart features to everything from lightbulbs to slow cookers. The goal is to be first to market, which often means security testing is treated as a final hurdle rather than the foundation of the build. When you bring a connected device into your home, you aren't just buying a vacuum; you are opening a digital window.