Summary
A misconfiguration in SharkNinja's AWS IoT policies allows attackers with a single device certificate to execute root commands on millions of robot vacuums. The flaw enables unauthorized access to cameras, Wi-Fi passwords, and home maps across entire AWS regions.
Take Action:
If you own a SharkNinja/Shark robot vacuum, disconnect it from the internet when the device is not operating until SharkNinja confirms a fix the flaw lets attackers remotely take control, view camera feeds, and steal your Wi-Fi password. Keep checking for and applying app/firmware updates. If your device must stay online, put it on a separate guest/IoT network away from your computers and phones.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)