Shark Robot Vacuums Exposed by Over‑Permissive AWS IoT Policy – Cameras, Home Maps, and Wi‑Fi Passwords Leaked
What Happened – An AWS IoT policy flaw in Shark’s cloud‑connected RV2320EDUS robot vacuum allows a stolen device certificate to publish and subscribe to MQTT topics for any Shark vacuum in the same AWS region. The researcher who disclosed the issue demonstrated remote control of other vacuums, enabling live camera feeds, extraction of plaintext Wi‑Fi passwords, and download of home‑layout maps.
Why It Matters for Compliance & Audit Readiness
- The flaw is a classic misconfiguration that bypasses logical segregation of device “shadows,” a scenario SOC 2 controls (CC6.1 Change Management, CC7.1 System Operations) are designed to detect and evidence.
- Continuous‑compliance programs must capture configuration drift and policy‑as‑code evidence; without it, a single compromised IoT certificate becomes a “skeleton key” for hundreds of devices.
- Verisq’s Control Mapping capability can automatically map the MQTT policy to SOC 2 control requirements and collect immutable proof of remediation for audit reviewers.
Who Is Affected – Consumer‑electronics manufacturers, IoT device vendors, smart‑home service providers, and any organization that integrates third‑party IoT hardware into its environment.
Recommended Actions
- Inventory all Shark (or similar) IoT devices and verify per‑device certificate scopes against the principle of least privilege.
- Map the MQTT policy to SOC 2 CC6.1/CC7.1 controls, capture configuration snapshots, and feed them into your continuous‑evidence pipeline.
- Engage the vendor for a firmware update that enforces per‑device shadow isolation; document the request and response as part of vendor‑risk evidence.
Technical Notes – The vulnerability stems from an overly broad AWS IoT Core MQTT policy that grants any device certificate the ability to publish/subscribe to all Shark device shadows in the same AWS Region (39 regions worldwide). Physical extraction of the device’s private key is required for the initial compromise; subsequent exploitation is fully remote via the cloud. The researcher observed ~1.5 M unique serial numbers and ~44 % of devices responded to remote‑command probes. Source: Malwarebytes Labs