<\/p>\n
Dennis Giese is an independent security and privacy researcher. (Supplied: Matthew Modoono\/Northeastern University)<\/p>\n
“I tried to get a security contact for the last four years,” says Giese.<\/p>\n
“But they effectively ghosted me.”<\/p>\n
After failing to establish a reliable contact with Dreame, the researcher reported the vulnerability to US cybersecurity agency CISA.<\/p>\n
CISA reproduced the exploit, and assigned it a “low attack complexity<\/a>” level in an alert it published last week. This means that the hack is not difficult to pull off for a sophisticated attacker.<\/p>\n The security flaw \u2014 a misconfigured check for security certificates in the app \u2014 allows network administrators to pretend to be Dreame’s own servers, and intercept user data.<\/p>\n Do you know more? Or have a Dreame robot in your home?<\/p>\n Contact Julian Fell at tips@jtfell.com<\/a><\/p>\n “Captured communications may include user credentials and sensitive session tokens,” reads the CISA advisory note.<\/p>\n “Dreame Technology did not respond to CISA’s request for coordination.”<\/p>\n The ABC has also verified the exploit by connecting a smartphone to a wi-fi network that Giese had set up.<\/p>\n The access point worked as expected. The phone was able to access the internet as usual when connected.<\/p>\n However, when we logged into the Dreame app, the researcher was able to intercept our password.<\/p>\n The ABC verifying the exploit on a network configured by Dennis Giese. (ABC News: Julian Fell)<\/p>\n Dreame said it had forwarded the ABC’s questions on to “the relevant teams for review”, but did not respond in time for publication.<\/p>\n “A formal statement addressing your questions will be provided to you once our assessment is complete,” the company said in an email.<\/p>\n Certified secure by multinational testing company<\/p>\n Dreame has its products certified as secure by a third-party.<\/p>\n Multinational testing company T\u00dcV S\u00dcD wrote in a 2022 press release<\/a> that it had “performed professional security tests and document reviews” on one of Dreame’s robot vacuum cleaners.<\/p>\n It has continued to do so for newer models, one of which was completed as recently as August 2025.<\/p>\n It is unclear whether the app itself was tested as part of this certification process.<\/p>\n T\u00dcV S\u00dcD did not respond to the ABC’s questions.<\/p>\n Ecovacs’ robots, which suffered from a separate security vulnerability, were certified to the same standard (called ETSI EN 303 645) by another testing company.<\/p>\n<\/p>\n