Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

A critical unpatched vulnerability in Shark robot vacuums allows attackers with access to a device's certificate to execute arbitrary commands on other vacuums within the same AWS region. The flaw stems from overly permissive AWS IoT policies that permit wildcard subscription and publishing to device shadows, enabling remote code execution, camera access, and Wi-Fi password theft. The issue affects older Shark vacuum models whose certificates were issued with unrestricted policies, and the fix requires server-side policy updates from SharkNinja, as no firmware update is needed. Despite being reported in March 2026, no patch or CVE has been issued as of July.

AI-extracted · verify before operational use