Robot Vacuum Flaw Could Give Hackers Control Over Millions of Home Devices

Research published by security researcher tokay0 describes a cloud-authorization flaw in SharkNinja robot vacuums that allowed overly permissive AWS IoT device certificates to be reused across devices, enabling remote code execution and access to cameras, stored home maps, and Wi‑Fi credentials; the researcher observed communications from ~1.5 million devices and ~673,000 exposing the vulnerable command handler, and SharkNinja reportedly issued a fix on July 20th after coordinated disclosure.