Hook: A researcher in Barcelona remotely accessed ~7,000 DJI ROMO vacuums — live camera feeds, mics and floorplans — just by using his own device token. DJI’s MQTT broker lacked topic-level ACLs, letting authenticated clients read everything. Wildcard access was patched Feb 8 & 10, but one critical bug remains unpatched as of Feb 17; DJI says it’ll fix it “within weeks.” This puts fresh heat on DJI amid ongoing regulatory scrutiny.