Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

A vulnerability in the Shark RV2320EDUS robot vacuum allows attackers to control other Shark vacuums in the same AWS region. By extracting the certificate from the vacuum's flash memory, an attacker can run root commands on other vacuums, enabling them to access the camera, operate the robot, and obtain the home's map. The attacker can also extract the Wi-Fi password in plaintext. A researcher demonstrated this method, which was tested on vacuums the researcher owned. The vulnerability can be exploited region-wide, affecting multiple devices. The method used to exploit the flaw was made public by the researcher.