Shark Vacuum RCE Flaw Lets Attackers Remotely Control Cameras and Motors

A critical RCE and privacy vulnerability was discovered in SharkNinja robot vacuums stemming from misconfigured AWS IoT Core policies and device certificates that permit wildcard MQTT subscriptions and delivery of arbitrary shell commands via an 'Exec_Command' field; the researcher demonstrated cross-model exploitation, observed ~10.5M messages across 1.5M device serials and estimated ~673K vulnerable devices in one region, enabling camera hijacking, motor control, and extraction of Wi‑Fi credentials, and the issue remained unpatched at the time of disclosure.