Shark Robot Vacuum
From Wiki-IoT
Revision as of 14:30, 25 October 2026 by RuiQin (talk | contribs) (Shark RV2320EDUS has an overly permissive AWS IoT certificate enabling cross-device command execution. Stored Wi-Fi passwords and maps in plaintext. Vendor claims server-side fix.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| Shark Robot Vacuum | ||
|---|---|---|
|
Security Grade
Calculator v
|
Shark Robot Vacuum (RV2320EDUS / AV1102ARUS)
Brand: Shark (Parent: SharkNinja) Category: Robot Vacuum • Model / Gen: RV2320EDUS / AV1102ARUS RV2320EDUS Release Date: 2022-12-28 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Very common | 🔗 Proof | UART pins exposed on mainboard; U-Boot console has no password, allowing root shell via init=/bin/sh. |
| Known vulnerabilities | Very common | 🔗 Proof | AWS IoT policy overly permissive; device private key allows MQTT wildcard subscription and remote command execution. |
| Prior attacks | Rare | 🔗 Proof | Researcher discovered accidentally during own device analysis; no confirmed malicious exploitation in the wild. |
| Updatability | Very common | 🔗 Proof | SharkNinja stated the vulnerability has been "completely addressed" server-side; no firmware update required. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | AWS IoT certificate was not scoped to the specific device; one certificate could address any device in the same region. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | TLS authentication used between device and AWS IoT Core; however, authorization was misconfigured. |
| Storage | No encryption | 🔗 Proof | Wi-Fi pre-shared key and house maps stored in plaintext on the device filesystem. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Absent | 🔗 Proof | No per-device authorization at the cloud broker level; any valid certificate could act on other devices. |
| Authentication | Absent | 🔗 Proof | Command execution via Exec_Command field required no additional authentication beyond a valid certificate. |
| Brute-force protection | Absent | 🔗 Proof | Not relevant; no brute-force needed. Serial number alone was sufficient to target a device. |
| Event logging | Absent | 🔗 Proof | No evidence of cross-device access logging or anomaly detection for unauthorized MQTT subscriptions. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Device certificate extractable via UART; no password protection on U-Boot console. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Embedded Linux (Companion App: SharkClean App) |
| Hardware (CPU / GPU) | CPU: Unknown (Embedded SoC) • GPU: None |
| Memory & Storage | Memory: Unknown • Storage: Internal Flash |
| Power, Battery & Charging | Battery: Built-in Lithium-ion Battery • Power: Charging Dock • Charging: Auto-recharge via Dock |
| Display & Camera | Display: None • Camera: Built-in Camera (for navigation/live view) |
| Sound & Connectivity | Sound: Built-in Speaker (Voice Assistant) • Connectivity: Wi-Fi (2.4GHz), AWS IoT Core MQTT |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
