Unpatched Shark vacuum flaw lets one stolen certificate control others region-wide

A researcher disclosed an unpatched flaw in internet-connected Shark robot vacuums that lets an attacker take control of other owners' units across the same cloud region. The certificate a vacuum uses to authenticate to its maker's Amazon cloud broker was never restricted to that one device, so a certificate pulled from a vacuum's flash memory can send root commands to any Shark vacuum the broker serves. That means watching the camera, driving the robot, reading the stored map of a home, and taking the Wi-Fi password in plaintext. No memory corruption or password guessing is needed. The researcher says the maker has had the report since March with no fix.

Check

If Shark robot vacuums are on your network, isolate them and other smart-home devices on a separate segment away from sensitive systems, keep their firmware current, and watch for the vendor's fix.

Affected

Owners of internet-connected Shark robot vacuums; an attacker with a certificate from one unit can run root commands on others region-wide, exposing camera feeds, home maps, and Wi-Fi passwords.

Fix

Isolate smart-home devices on their own network segment, limit what they can reach, and watch for the vendor to rescope its cloud certificate policy or reissue certificates, the real fix here.