Preliminary research
No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE
AI-collected research leads through 1 October 2026, including a bounded September review of selected social and community sources. Unranked, incomplete, not community-vetted, and subject to change.
A certificate extracted from one Shark vacuum can subscribe and publish across other devices' AWS IoT MQTT topics because broker authorization is not tenant-scoped. Reverse engineering finds an Exec_Command field that passes short strings to popen, and a second owned model confirms cross-device root command execution.
Record
- Published by
- tokay0.com
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of tokay0.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .