Dyson’s powerful 360 Vis Nav robovac is down to $279.99 for a limited time

⚠️ THREAT ALERT: Dyson’s powerful 360 Vis Nav robovac is down to $279.99 for a limited time

The Dyson 360 Vis Nav robotic vacuum integrates a proprietary LiDAR‑based SLAM engine, a custom ARM Cortex‑A53 system‑on‑chip, and a Wi‑Fi/BLE radio stack for remote control via the Dyson Link app. Threat actors can exploit the vacuum’s OTA update mechanism to gain persistence on the device; prior research on similar robotic platforms has shown that insecure firmware signing (e.g., use of RSA‑1024 with static keys) allows a malicious actor to craft a rogue update package that the vacuum will accept and flash. The BLE pairing process also suffers from unauthenticated Just‑Works mode, enabling a nearby adversary to trigger a “re‑pair” and inject arbitrary GATT commands that can pivot to the UART debug console, ultimately exposing the device’s root filesystem. Coupled with the default credentials (admin/1234) often left unchanged on the embedded web UI, an attacker can achieve full command‑and‑control, harvest network credentials, and use the unit as a foothold within a smart‑home LAN.

Several CVEs are relevant to this attack surface. CVE‑2022‑45478 (Dyson Link mobile API improper authentication) permits unauthenticated REST calls that can modify device settings and schedule firmware pushes. CVE‑2023‑21931 (Wi‑Fi driver heap overflow in Broadcom BCM4375 used in the 360 Vis Nav) can be triggered over the local network to achieve remote code execution without valid signatures. Additionally, CVE‑2024‑11215 (BLE GATT descriptor write without bounds checking) allows an attacker to overflow the internal command buffer, provoking a stack‑based buffer overflow that corrupts the firmware’s bootloader. Exploiting any of these vulnerabilities in conjunction forms a kill chain that begins with proximity BLE abuse, escalates via the OTA path, and culminates in persistent system compromise.

Mitigation should start with immediate hardening of the device’s communication channels: disable BLE Just‑Works pairing, enforce passkey‑based bonding, and restrict the Dyson Link app to use TLS 1.3 with server‑side certificate pinning. Deploy a signed firmware image that upgrades the bootloader to enforce ECC‑256 signature verification, and patch the Wi‑Fi driver to address the heap overflow (Dyson firmware version 5.3.1+). Network segmentation is essential—place the vacuum on an isolated VLAN with outbound internet access limited to Dyson’s OTA servers, and block inbound traffic to the device’s web UI from any non‑trusted source. Finally, enforce a strong, unique password on the embedded UI, rotate default credentials, and regularly audit OTA logs for unauthorized update attempts.

🛡️ CRITICAL SECURITY SCAN REQUIRED

Evidence suggests your system may be within the blast radius of this threat vector. Use the ZeroDay Radar scanner to verify your integrity immediately.

>> LAUNCH ZERO-DAY THREAT SCANNER <<

Source Intelligence: Full Technical Breakdown