--- title: Shark vacuum flaw exposes cameras, home maps and Wi-Fi... description: A security researcher discovered an unpatched AWS IoT policy misconfiguration in Shark robot vacuums that allows a certificate stolen from one device to send... canonical: https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords | daily.dev og:description: A security researcher discovered an unpatched AWS IoT policy misconfiguration in Shark robot vacuums that allows a certificate stolen from one device to send... og:url: https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b og:image: https://api.daily.dev/og/posts/dw7t89T2b.png og:image:alt: Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 4 min read · 3 upvotes · 0 comments ## Summary A security researcher discovered an unpatched AWS IoT policy misconfiguration in Shark robot vacuums that allows a certificate stolen from one device to send commands to any other Shark device in the same AWS Region. The overly permissive MQTT policy means an attacker with physical access to one vacuum could remotely access cameras, steal plaintext Wi-Fi passwords, and copy home floor maps from hundreds of thousands of other devices. During a 24-hour observation window, over 1.5 million unique Shark serial numbers were seen, with ~44% supporting remote command execution. SharkNinja has not patched the issue despite being notified more than six months ago. Owners are advised to disable remote features or disconnect the device from Wi-Fi until a fix is released. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Shark Vacuum Vulnerability Lets Attackers Hijack Cameras Across an Entire AWS Region](https://daily.dev/posts/shark-vacuum-vulnerability-lets-attackers-hijack-cameras-across-an-entire-aws-region-5gquma1jc) · Latest Hacking News · 2 upvotes · 1 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-sjoldf7cj) · Schneier on Security · 0 upvotes · 0 comments --- Tags: [#tech-news](https://daily.dev/tags/tech-news), [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#backend](https://daily.dev/tags/backend) [View this post on daily.dev](https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords","url":"https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b"},"datePublished":"2026-07-17T13:30:36.900Z","dateModified":"2026-07-17T13:31:03.183Z","description":"A security researcher discovered an unpatched AWS IoT policy misconfiguration in Shark robot vacuums that allows a certificate stolen from one device to send...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/shark-vacuum-flaw-exposes-cameras-home-maps-and-wi-fi-passwords-dw7t89t2b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"tech-news,security,aws,backend","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords"}]} ```