Shark vacuum’s AWS certificate lets attackers hijack any model in the region
A Shark RV2320EDUS robot vacuum’s AWS IoT certificate can be used to issue root commands to any Shark vacuum in the same AWS region, exposing live camera feeds, home maps, and Wi‑Fi passwords. The flaw stems from an overly permissive device policy that SharkNinja never scoped to individual devices, and it remains unpatched.