Chinese drone giant DJI, whose products are widely sold across Australia, has paid A$45,000 to a U.S. security researcher after he uncovered a major vulnerability that reportedly exposed access to thousands of cameras embedded in DJI devices that are used inside homes.

The discovery was made by Kevin Finisterre, who said he was able to access a network of around 7,000 DJI-connected cameras using nothing more than a PlayStation game controller, potentially allowing outsiders to view inside private homes.

DJI described the payment as a “thank you” reward for identifying a security vulnerability in its newly released robotic vacuum cleaners. However, the incident has renewed concerns about the company’s track record on device security.

This is not the first time Finisterre has raised alarms about DJI’s systems. In 2017, he reported earlier security weaknesses involving the company’s camera infrastructure, sparking scrutiny of how DJI protects user data and device access.

The latest payment relates to a single vulnerability, according to an email Finisterre shared with The Verge, though DJI has not disclosed exactly which flaw prompted the payout.

Industry sources told ChannelNews that another vulnerability—described internally as “bad”—has also been identified. DJI reportedly believes it will patch that issue within a month.

The revelations come amid growing international scrutiny of DJI’s technology. In December 2025, the U.S. government added DJI to the Federal Communications Commission’s “Covered List.” The designation means new DJI drones generally cannot be approved for sale in the United States unless national-security agencies clear them.

The restriction effectively blocks future DJI products from entering the U.S. market, prompting the company to look toward other regions, including Australia, to expand sales of its drones, cameras and emerging consumer devices.

U.S. officials say the restrictions are driven by national security concerns surrounding Chinese technology, warning that drones and connected devices could potentially collect video and mapping data and transmit it back to servers in China.

With DJI continuing to push new consumer products into international markets, the latest security incident is likely to intensify calls for greater scrutiny of connected cameras and smart home devices sold in Australia and beyond.