Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

Summary: A researcher publishing as tokay0 showed that a certificate pulled from the flash of a Shark RV2320EDUS robot vacuum, whose AWS IoT policy was never scoped to the individual device, can be used to publish commands to other Shark vacuums in the same AWS region, reaching cameras, maps, and plaintext Wi-Fi passwords. He reported the flaw to SharkNinja on March 1 and published on July 13 after no fix confirmation arrived, and in one region over 24 hours he counted 1,517,605 unique Shark serial numbers, of which 673,816 (44%) returned an Exec_Response indicating the command handler runs.
Why it matters: The fix sits in SharkNinja's AWS account, not in owners' firmware, so until the company rescopes the policy or reissues certificates the only mitigation for an owner is to disconnect the vacuum from Wi-Fi. Four months after the report there was no CVE, no CVSS score, and no advisory for a vulnerability management program to key on.

Read the original at The Hacker News ↗