← Robot Vacuums
D

Ecovacs Deebot X2

Hackers drove these around homes yelling racial slurs through the speaker. Camera accessible remotely.
Serious concerns
Ecovacs Robotics · 🇨🇳 China · WiFi
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
FCC ID: 2AZAT-DEX86
Chipset: Unknown (proprietary Ecovacs platform)
App: com.eco.global.app
Manufacturer: Ecovacs Robotics
Model: Deebot X2 Omni

⚠️ The bottom line

Ecovacs says your data is protected by encryption, but security researchers found the encryption keys are predictable and can be guessed from your device serial number. This means the lock on your data is essentially broken — anyone with basic technical knowledge could read your home camera footage and audio recordings. Ecovacs says you can delete your photos and recordings from their servers. But buried in the same policy, they say deleted data "may continue to be held and used." In other words, pressing delete might not actually delete anything — they can keep your home photos and voice recordings forever.

Legal jurisdiction
🇨🇳 China (headquarters)
National Intelligence Law read more →
Company must secretly hand data to Chinese intelligence on request
Data Security Law read more →
State can classify any data as 'important' and demand access for national security
Spying
4/4 EXTREME
Is someone spying on me?
Data Sharing
4/4 EXTREME
Who gets my data?
Security
4/4 EXTREME
Is it actually secure?
Honesty
3/4 HIGH
Can I trust what they say?
REPLACE Extreme risk. Look for alternatives or lock down hard.
13Contradictions
4Critical
5High
4Medium
8Sources
Findings by concern
Spying 4/4 EXTREME 6 findings
⚠️ criticalpolicy claims vs firmware analysis
The camera is sold as a cleaning aid to avoid obstacles, and the microphone as a voice assistant. But security researchers proved both can be secretly turned on by hackers from a football field away. In 2024, strangers actually did this to families in their homes — watching them through the robot camera while yelling through its speaker.

What they claim: Ecovacs markets the front-facing camera as an "AI obstacle avoidance" feature for cleaning, and the YIKO voice assistant as a convenience feature for voice commands

What we found: DEF CON 2024 research (Dennis Giese, Braelynn Luedtke) demonstrated the camera and microphone can be remotely activated without owner knowledge via Bluetooth hijacking from 130+ metres away. The PIN system meant to protect camera/microphone access can be bypassed. Real-world hacking incidents in May 2024 confirmed attackers accessed live camera feeds in homes across the US

⚡ highapp permissions vs policy claims
The app for a robot vacuum asks for permission to use your phone camera, record audio, track your precise location, change system settings, and identify you for advertising. It also sends data to Chinese analytics services. None of these are needed to tell a vacuum where to clean.

What they claim: Ecovacs describes the app as a cleaning control interface — the privacy blog emphasizes they only collect data needed for device operation

What we found: Exodus Privacy report shows the ECOVACS HOME app (v3.11.0) requests 49+ permissions including CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, WRITE_SETTINGS, SYSTEM_ALERT_WINDOW, GET_TASKS, and SMARTCARD. It embeds 4 trackers including JiGuang Aurora Mobile JPush (Chinese push notification service) and Sensors Analytics (Chinese analytics). The app also uses AD_ID for advertising tracking. A cleaning robot app does not need camera access, audio recording, or advertising identifiers

⚡ highfirmware analysis vs regulatory findings
The charging base for your robot vacuum accepts software updates without checking if they are genuine. Because the Wi-Fi password between the robot and its base can be guessed from the serial number, an attacker could install malicious software on your base station — giving them persistent access to the robot camera, microphone, and your home network.

What they claim: The Deebot X2 Omni base station should provide secure firmware updates to maintain device integrity

What we found: CVE-2025-30199 (CVSS 8.6) reveals base stations do not validate firmware update integrity. Combined with CVE-2025-30198 (hard-coded WPA2-PSK keys derived from serial numbers), an attacker can inject malicious firmware into the base station, potentially turning the entire robot-base system into a persistent surveillance platform with camera, microphone, and network access

⚡ highapp permissions vs firmware analysis
The robot trusts any Bluetooth connection as fully authorized — if someone connects via Bluetooth, they get complete access to the camera and microphone with no password needed. Researchers showed this can be done from 130 metres away, meaning someone outside your house could hijack your vacuum and start watching through its camera.

What they claim: The app includes Bluetooth permissions (BLUETOOTH_CONNECT, BLUETOOTH_SCAN, BLUETOOTH_ADVERTISE) for device setup and connectivity

What we found: DEF CON 2024 researchers demonstrated that the Bluetooth connection is the primary attack vector — connections can be hijacked from 130+ metres away. Once Bluetooth pairing is established, the device grants full access including camera and microphone activation with no additional authentication. The broad Bluetooth permissions in the app reflect an architecture where Bluetooth trust equals full device access

⚫ mediumregulatory findings vs firmware analysis
The US government approved this robot vacuum for sale after checking its radio signals were safe. But nobody checked whether the camera and microphone could be hacked. Within a year, hackers were remotely activating these sensors to spy on American families. The approval process has a blind spot for exactly these risks.

What they claim: The FCC filing certifies the Deebot X2 Omni for consumer use with standard radio emissions compliance

What we found: The FCC filing (2AZAT-DEX86) approved the device with dual-laser LiDAR, HD camera, RGBD depth sensor, microphone, and speaker — making it one of the most sensor-rich consumer devices ever certified. Yet the FCC process evaluates only radio emissions compliance, not the security of these sensors. Within a year of FCC approval, the device was involved in real-world hacking incidents where cameras and microphones were remotely activated in US homes

⚫ mediumpolicy claims vs firmware analysis
Ecovacs sells this as a cleaning robot, but it has a camera, microphone, depth sensor, and laser scanner — essentially the same sensors as a surveillance drone. Each sensor has a cleaning-related excuse, but together they create a device that can see, hear, and map every room in your home while moving freely through your house.

What they claim: Ecovacs markets the Deebot X2 Omni as a premium cleaning robot with AI-powered features for better cleaning performance

What we found: The device contains: front-facing HD camera, RGBD depth sensor, dual-laser LiDAR, microphone (always listening for YIKO wake word), speaker, Wi-Fi, and Bluetooth — a sensor suite equivalent to a mobile surveillance platform. The marketing positions each sensor as a cleaning feature (camera for obstacle avoidance, LiDAR for mapping, microphone for voice commands) but collectively they create a comprehensive home surveillance capability that roams autonomously through every room

Data Sharing 4/4 EXTREME 3 findings
⚡ highpolicy claims vs regulatory findings
Ecovacs says their "Product Improvement Program" is optional and anonymises your data. But their own engineers admitted in a blog post that they needed exactly the kind of photos their vacuums take inside homes. The program appears designed from the start to collect images of your private spaces to train their AI.

What they claim: Ecovacs claims data collection through the Product Improvement Program is opt-in and anonymised at the machine level

What we found: The AI training disclosure (Schneier, 2024-10-04) reveals Ecovacs collects 2D/3D home maps, voice recordings, and photos/videos from device cameras for AI training. A 2020 Ecovacs engineering blog post admitted the company needed ground-level perspective images that robot vacuums capture — suggesting the program was designed specifically to harvest customer home data to solve their training data shortage

⚫ mediumregulatory findings vs policy claims
Your robot vacuum creates a detailed 3D map of your home, records audio, and can take photos — all of which gets sent to servers run by a Chinese company. Under Chinese law, the government can access this data. Ecovacs does not clearly disclose this in their marketing materials.

What they claim: Ecovacs is headquartered in Suzhou, China, processing home maps, camera footage, and audio on Chinese servers

What we found: The privacy policy discloses data sharing with third parties for marketing and potential data sales. Firmware endpoints (portal-as.ecouser.net, api-app.dc-as.ww.ecouser.net) route data through Asian servers. Under Chinese law (National Security Law, Data Security Law, PIPL), authorities can compel access to data stored by Chinese companies. Users 3D home maps, camera footage, and voice recordings are subject to Chinese government data access requirements — undisclosed in marketing

⚫ mediumapp permissions vs regulatory findings
The app uses Chinese push notification services to send you alerts about your vacuum. This means even your notification data — like when you are home cleaning or away — goes through Chinese servers, in addition to the camera footage and home maps already being sent to Ecovacs in China.

What they claim: The ECOVACS HOME app includes MIPUSH_RECEIVE and JPUSH_MESSAGE permissions for push notifications

What we found: MIPUSH (Xiaomi Push) and JPUSH (JiGuang Aurora Mobile) are Chinese push notification services that route notification data through Chinese infrastructure. These are embedded alongside the Sensors Analytics Chinese analytics tracker. For a device that collects home maps, camera footage, and audio, routing notification metadata through Chinese servers creates additional data exposure pathways beyond the primary Ecovacs cloud connection

Security 4/4 EXTREME 3 findings
⚠️ criticalpolicy claims vs regulatory findings
Ecovacs says your data is protected by encryption, but security researchers found the encryption keys are predictable and can be guessed from your device serial number. This means the lock on your data is essentially broken — anyone with basic technical knowledge could read your home camera footage and audio recordings.

What they claim: Ecovacs privacy blog states they take privacy seriously and data is encrypted with AES-128, presenting the robot as privacy-respecting

What we found: CVE-2025-30200 reveals the AES encryption keys are hard-coded and predictable, derivable from device identifiers. The encryption Ecovacs touts as protecting user data is fundamentally broken — anyone who knows the serial number can decrypt camera feeds, audio, and map data

⚠️ criticalmarketing vs third party research
A lawyer in Minnesota was watching TV when his robot vacuum started screaming racial slurs and chasing his dog around the house. A hacker had taken control — driving the robot, watching through its camera, yelling through its speaker. It happened to families across America. A Bluetooth flaw let attackers take over from 100 metres away. Your vacuum cleaner, weaponised.

What they claim: Ecovacs Deebot X2 Omni promoted as an intelligent home cleaning robot

What we found: In 2024, multiple families across US cities reported their Ecovacs Deebot X2 Omni vacuums being hijacked by hackers who drove the robots around homes while shouting racial slurs through the speakers. A Minnesota lawyer reported his vacuum chasing his dog while screaming obscenities. Researchers traced the vulnerability to a Bluetooth connection flaw that allowed access from over 100 metres away.

⚡ highpolicy claims vs app permissions
Ecovacs says they comply with privacy regulations. But Mozilla found they fail even the most basic security standards and have no way for security researchers to report bugs. They also sell your data to marketers unless you figure out how to opt out — and the app sends your usage data to Chinese analytics companies.

What they claim: Ecovacs privacy blog states they comply with regulations and protect user data according to CCPA requirements

What we found: Mozilla Privacy Not Included review found Ecovacs fails minimum security standards, has no vulnerability management or bug reporting program, and may sell personal data unless users actively opt out. The app includes AD_ID for advertising tracking and Chinese analytics trackers (JiGuang JPush, Sensors Analytics). The CCPA disclosure reveals data is shared with third parties for marketing without opt-in consent

Honesty 3/4 HIGH 1 finding
⚠️ criticalpolicy claims vs regulatory findings
Ecovacs says you can delete your photos and recordings from their servers. But buried in the same policy, they say deleted data "may continue to be held and used." In other words, pressing delete might not actually delete anything — they can keep your home photos and voice recordings forever.

What they claim: Ecovacs privacy policy states deleted recordings and images can be erased from servers upon request

What we found: The same privacy policy contains the clause that deleted recordings and images "may continue to be held and used by Ecovacs." Bruce Schneier (2024-10-04) highlighted this contradiction — the company simultaneously promises deletion rights while reserving the right to keep and use the data indefinitely

Sources