Loading story…
A security researcher disclosed an unpatched SharkNinja vulnerability that could let an attacker use a certificate extracted from one Shark robot vacuum to send root-level commands to other Shark vacuums in the same AWS region. The issue reportedly combines overly broad AWS IoT policies with an Exec_Command field in the device shadow that the vacuum management daemon executes via popen, enabling remote code execution across devices rather than limiting access to a single unit.
The researcher demonstrated cross-model compromise by pulling a certificate from a Shark RV2320EDUS and using it to gain a reverse shell on an AV1102ARUS, then accessing the camera feed, driving the robot, reading home maps, and retrieving plaintext Wi-Fi credentials. Over a 24-hour period, the researcher observed 1,517,605 unique Shark serial numbers in one AWS region and saw 673,816 devices emit Exec_Response, indicating broad exposure; SharkNinja had reportedly been notified in March but had not published an advisory, assigned a CVE, or confirmed a fix, leaving owners with little practical mitigation beyond disconnecting affected vacuums from Wi-Fi.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
In June 2026, researcher tokay0 requested a MITRE identifier for the SharkNinja robot vacuum vulnerability chain. The reference says the issue still had not received a CVE or CVSS score by the time of disclosure.
Over a 24-hour period, the researcher observed 1,517,605 unique Shark serial numbers in one AWS region and saw 673,816 devices emit Exec_Response. This suggested that a large number of Shark vacuums may implement the vulnerable command handler.
tokay0 demonstrated that a certificate extracted from a Shark RV2320EDUS could be used to issue commands to another model, an AV1102ARUS, and obtain a reverse shell. The demonstration reportedly enabled access to the camera feed, robot controls, house maps, and plaintext Wi‑Fi credentials.
A researcher using the handle tokay0 reported an IoT vulnerability to SharkNinja in March. According to the report, the flaw involved overly permissive AWS IoT policies and an Exec_Command path that could enable root-level command execution across devices in the same AWS region.
The vulnerability was publicly disclosed as affecting Shark robot vacuums, with the report stating that SharkNinja had not published an advisory, assigned a CVE, or confirmed a fix by the time of publication. The only practical mitigation described for owners was disconnecting affected vacuums from Wi‑Fi because remediation would need to occur server-side in SharkNinja's AWS environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcereddit.com
Open sourcetokay0.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Mirai-based botnet variant named **ShadowV2** was observed exploiting a major AWS outage in October to infect IoT devices across 28 countries. Security researchers at Fortinet’s FortiGuard Labs reported that ShadowV2 leveraged at least eight known vulnerabilities in devices from vendors such as D-Link, TP-Link, DD-WRT, DigiEver, and TBK. The botnet propagated rapidly during the day-long AWS disruption, targeting routers, NAS devices, and DVRs in sectors including government, technology, manufacturing, telecommunications, education, and managed security service providers. The attackers used a downloader script (`binary.sh`) to deliver the malware, which then connected to command-and-control infrastructure to receive further instructions. The campaign appeared to be a test run, as the botnet was only active during the AWS outage and did not persist beyond that period. Notably, some of the exploited vulnerabilities, such as `CVE-2024-10914` and `CVE-2024-10915`, affect end-of-life D-Link devices for which no patches are available, leaving many systems permanently exposed. D-Link updated its advisories to warn users about the risks to unsupported devices, while TP-Link addressed one of the flaws with a beta firmware update. The ShadowV2 botnet’s global reach and ability to exploit multiple unpatched IoT vulnerabilities highlight the ongoing risks posed by insecure and unsupported connected devices, especially during periods of widespread internet infrastructure disruption.
Jun 29, 2026
Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in **DJI Romo robot vacuums** allowed a researcher to obtain access tokens for more than **6,700** other vacuums and view sensitive user data such as **home floor plans**, **live video feeds**, and **microphone input**; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game *Dungeon Crusher* exposed user information after a **misconfigured Elasticsearch** instance leaked **24.5 million** in-game chat records and purchase-related data, including **IP addresses**, **email addresses**, and **partial payment card details**, creating downstream risk for fraud and targeted phishing. Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented **FlyTrap**, a physical-world attack against **autonomous target-tracking drones** in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that **Tire Pressure Monitoring System (TPMS)** sensors broadcast a fixed **unique ID** in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from **20,000+ vehicles** during a multi-week study.
Jun 29, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026