Robot vacuum cleaners have long been driving around their homes unattended, but some Shark models, along with cleaning, opened an inconspicuous path for outsiders. A security specialist has discovered a critical vulnerability that allows the Internet to execute commands on devices, manage their movement and access the collected data.
The problem is related to the SharkNinja cloud system, through which vacuum cleaners exchange messages with Amazon servers. Each device uses its own certificate and private key, but for some devices, the access rights were not set up correctly. The certificate of one vacuum cleaner allowed to subscribe to the messages of other devices and send them commands.
During the inspection, the specialist found in the software the Exec_Command function. The vacuum cleaner took the line received from the cloud and transmitted it to the system shell without sufficient verification. As a result, the owner of one vulnerable device could perform an arbitrary code on another vacuum cleaner, knowing only its serial number.
The specialist confirmed the attack on two models of Shark, RV2320EDUS and AV1102ARUS. The first device certificate allowed you to send the command to the second and run a third-party file on it. The test also showed that the vulnerability works on different models.
The consequences are not limited to starting and stopping cleaning. Some vacuum cleaners are equipped with a camera and store a room map, a password for a home Wi-Fi network in the public form and other official data. The author of the check was able to receive an image from the camera, remotely control the engines and move the device around the house.
During the day of observation of the cloud, the specialist recorded more than 1.5 million unique devices. At least 673 816 of them sent answers confirming the support of the dangerous team. The result applies to only one Amazon region, so the total number of vulnerable devices can be significantly higher.
In this case, the settings differ from model to model. The AV1102ARUS certificate did not allow you to view other people's messages, while the newer firmware RV2320EDUS received excessive rights. According to the author of the inspection, an erroneous access policy appeared later and spread to most of the connected devices of Shark.
The problem was reported by SharkNinja in March 2026. The company confirmed that it received the materials, but after more than four months did not release the correction and did not name the exact date of its release. The specialist also applied to MITRE to register the vulnerability, but the CVE identifier has not yet been assigned. Technical programs for the attack, the author did not publish, as the vulnerability remains open.
The problem is related to the SharkNinja cloud system, through which vacuum cleaners exchange messages with Amazon servers. Each device uses its own certificate and private key, but for some devices, the access rights were not set up correctly. The certificate of one vacuum cleaner allowed to subscribe to the messages of other devices and send them commands.
During the inspection, the specialist found in the software the Exec_Command function. The vacuum cleaner took the line received from the cloud and transmitted it to the system shell without sufficient verification. As a result, the owner of one vulnerable device could perform an arbitrary code on another vacuum cleaner, knowing only its serial number.
The specialist confirmed the attack on two models of Shark, RV2320EDUS and AV1102ARUS. The first device certificate allowed you to send the command to the second and run a third-party file on it. The test also showed that the vulnerability works on different models.
The consequences are not limited to starting and stopping cleaning. Some vacuum cleaners are equipped with a camera and store a room map, a password for a home Wi-Fi network in the public form and other official data. The author of the check was able to receive an image from the camera, remotely control the engines and move the device around the house.
During the day of observation of the cloud, the specialist recorded more than 1.5 million unique devices. At least 673 816 of them sent answers confirming the support of the dangerous team. The result applies to only one Amazon region, so the total number of vulnerable devices can be significantly higher.
In this case, the settings differ from model to model. The AV1102ARUS certificate did not allow you to view other people's messages, while the newer firmware RV2320EDUS received excessive rights. According to the author of the inspection, an erroneous access policy appeared later and spread to most of the connected devices of Shark.
The problem was reported by SharkNinja in March 2026. The company confirmed that it received the materials, but after more than four months did not release the correction and did not name the exact date of its release. The specialist also applied to MITRE to register the vulnerability, but the CVE identifier has not yet been assigned. Technical programs for the attack, the author did not publish, as the vulnerability remains open.
