Robot vacuums are supposed to clean the house. Turns out this one was mapping it for strangers. Security researchers have disclosed a critical vulnerability affecting SharkNinja’s cloud-connected robot vacuums that could allow attackers to remotely access sensitive information, including live camera feeds, home maps, Wi-Fi passwords, and even execute commands on affected devices. More concerningly, the issue reportedly remains unpatched despite being responsibly disclosed to SharkNinja months ago.
How can a vacuum become a spy?
The flaw was discovered by security researcher tokay0, who reverse-engineered a Shark RV2320EDUS robot vacuum. According to the research, the device contains an AWS IoT certificate that is allowed to communicate with other Shark devices in the same AWS region, rather than being restricted to its own device. That overly broad cloud policy effectively allows a certificate extracted from one vacuum to interact with many others.
If exploited, an attacker could remotely issue commands to vulnerable vacuums, access camera feeds, download maps of a user’s home, retrieve Wi-Fi passwords reportedly stored in plaintext, and potentially gain a foothold on the victim’s local network. The researcher observed more than 1.5 million unique Shark devices in a single AWS region over 24 hours, with around 673,000 devices responding in a way that suggested support for remote command execution. While that doesn’t confirm every one of those devices is exploitable, it indicates the issue could affect a very large number of products.
To be fair, the attack isn’t as simple as someone hacking a vacuum over the internet. To begin with, an attacker first needs physical access to a compatible Shark vacuum in order to extract its embedded certificate through a debug interface. That significantly raises the barrier to entry, making the attack more likely to be carried out by skilled researchers or determined attackers rather than opportunistic hackers.
The bad news is that once such a certificate has been extracted, the rest of the attack can take place remotely through SharkNinja’s cloud infrastructure. According to the researcher, the underlying problem lies in the company’s cloud-side AWS IoT policy, meaning users can’t fix it themselves with a firmware update. The required mitigation has to be implemented by SharkNinja on its servers.
What should Shark owners do?
The researcher says the vulnerability was first disclosed to SharkNinja in March 2026, but no patch had been released at the time of publication. Reports also note that there is currently no CVE identifier assigned for the issue, and SharkNinja has yet to publicly announce a fix.
Until the company addresses the problem, users who don’t rely on smart features may want to consider disconnecting their robot vacuum from Wi-Fi or disabling remote functionality to reduce the attack surface. It’s a temporary workaround rather than a true fix, but since this is a cloud-side vulnerability, the responsibility ultimately lies with the manufacturer.
