Preliminary research
No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE
AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.
A certificate extracted from one Shark vacuum can subscribe and publish across other devices' AWS IoT MQTT topics because broker authorization is not tenant-scoped. Reverse engineering finds an Exec_Command field that passes short strings to popen, and a second owned model confirms cross-device root command execution.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.