Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide

A researcher known as tokay0 published a method on Monday to extract the certificate from a Shark RV2320EDUS robot vacuum's flash memory, enabling root access to other Shark vacuums in the same AWS region. The exploit could allow attackers to view camera feeds, drive the robot, read house maps, and obtain Wi-Fi passwords in plaintext. Testing was limited to vacuums the researcher owned.