6 robot vacuum models hacked
- Commissioned by
- Korea Internet & Security Agency (KISA)
Project on vulnerability management measures for consumer IoT products - Period
- Mar – Jul 2025
Anything that moves is dangerous in the wrong hands
Successful Pwn2Own exploits two years running · 6 robot vacuum models hackedWe actually attack robots and autonomous systems to see whether control commands can be altered from outside to make the machine move.
There are no established security regulations for robots yet. So there's only one benchmark: real experience breaking into them.
It's not data on a screen that changes — it's real-world movement. ZIEN reproduces these scenarios hands-on to verify they can be stopped.
Going through app and cloud accounts, attackers pull out camera footage and a map of the home's layout. Even the living room layout and daily routines are laid bare.
Attackers get in through the maintenance port and lift the speed and range-of-motion limits. Even when the arm moves along an unusual path, no one notices.
Attackers intercept the wireless control signal and send commands that look legitimate. The operator's controller is unchanged — yet the robot dog follows someone else.
Industrial and service robots, as well as autonomous systems.
When a robot is hacked, it physically moves. Even without set regulations, checking it from an attacker's perspective before launch reduces the risk of accidents and recalls.
Yes. We have a track record of breaking into real products, including security testing of 6 robot vacuum models, hacking a robot dog (Deep Robotics Lite3), and successful Pwn2Own exploits two years in a row. You can see the cases in TRACK RECORD above.
We look at every path an attacker could take — the app and cloud that control the robot, the robot's firmware and hardware debug ports, and wireless communications such as Wi-Fi and BLE.
Reproduction steps and safety impact for each attack scenario, a remediation guide and retest results.
Yes. Testing at the prototype stage makes design changes easier and less costly. When the firmware is updated after launch, we retest the parts that changed.
We agree on the test scope and safety conditions in advance, and do hands-on work such as hardware analysis on samples we've agreed on with you.
There are no security regulations specific to robots yet, but EU RED 3.3 may apply if the product has wireless functions, the EU CRA if it contains software, and the EU Machinery Regulation if it's industrial machinery.
Results are delivered only to you under a non-disclosure agreement and are never disclosed without your consent.
Just tell us what to test — we'll reply within 5 business days with a proposed scope and timeline.
support@zi-en.io · +82-70-4571-9854
Robot vacuums
Robot vacuums
Firmware vulnerabilities