Security researcher Tokay0 has found a serious vulnerability affecting robot vacuum cleaners from Massachusetts firm SharkNinja.

A certificate extracted from one compromised Shark robot vacuum could be used to access other devices, exposing live camera feeds, stored home maps and wifi credentials held in plain text. During a 24-hour observation, the researcher identified more than 1.5 million Shark serial numbers in one AWS region, with approximately 674,000 devices responding to a command probe.

The vulnerability was patched by SharkNinja on 20 July.

“This is a classic authentication-versus-authorisation failure,” said Edwin Shuttleworth, lead penetration tester at Finite State (finitestate.io). “The certificate issued to each device correctly authenticated the holder of that device’s private key. An attacker who had fully compromised a vacuum could extract the key and authenticate as that legitimate device. The cloud backend, however, did not correctly enforce authorisation. As a result, a validly authenticated device was permitted to access data and perform actions involving other devices it should not have been able to reach.”

Shuttleworth said this was a common security design mistake: treating a successfully authenticated identity as broadly trusted instead of applying narrowly scoped, per-device permissions.

“Security professionals reviewing IoT systems should verify both that device identities are unique and that each identity is restricted to its own resources and required operations,” he said. “Manufacturers must assess the complete connected-product environment because the most serious vulnerabilities often arise from interactions between multiple layers rather than a single isolated flaw. This case illustrates that clearly.”

He said weaknesses in the device’s boot and debug protections allowed an attacker to obtain privileged access to the vacuum and extract its credentials. Those credentials were then accepted by the cloud service and granted access to MQTT resources belonging to other devices. Finally, dangerous command-handling functionality allowed cloud-delivered messages to result in remote code execution.

“Individually, each weakness might have appeared limited,” said Shuttleworth. “Together, they created an attack chain that turned the compromise of one physical device into a potential fleet-scale compromise. Testing firmware, cloud permissions, credential storage or backend infrastructure only in isolation could therefore miss the true severity of the vulnerability.”

He said manufacturers should avoid storing sensitive information that is not necessary for the device’s function or business operations and should avoid transmitting sensitive information to the cloud when it is not needed.

“When information must be transmitted, robust encryption should be used to prevent access by unauthorised parties,” he said. “Security testing must also be performed early and regularly to prevent compromises like this and minimise their impact when they occur.”

The vulnerability report (tokay0.com/posts/millions-of-shark-vacuums-vulnerable-to-rce.html) quotes SharkNinja as saying: “SharkNinja is aware of the researcher’s report on some of our robot vacuums, and we have completely addressed the identified vulnerability. We take privacy and data security incredibly seriously, and we remain committed to protecting the privacy and data security of our consumers.”

IMC Smart Building & Construction News has asked SharkNinja (www.sharkninja.com) if it wishes to comment further.