AWS IoT – CyberSecurityBoard

Critical CVEs

Unpatched Shark Vacuum Flaws Expose Millions to Remote Code Execution via AWS IoT Misconfiguration

A security researcher publishing under the handle tokay0 has disclosed an unpatched vulnerability in SharkNinja's Shark robot vacuum cleaners that could allow…

Amazon Web Services (AWS) AV1102ARUS AWS Device Defender AWS IoT

July 16, 2026

Cyber Companies

AWS IoT and Device Defender: Critical Policy Misconfiguration

AWS IoT's Device Defender service includes an audit check (IOT_POLICY_OVERLY_PERMISSIVE_CHECK) that flags overly permissive policies granting publish/subscribe on $aws/things/*. This misconfiguration, rated…

Amazon Web Services (AWS) AWS Device Defender AWS IoT IoT security

July 16, 2026

Cyber Products

AWS IoT: Device Shadow and Policy Misconfiguration

AWS IoT's device shadow service is central to the Shark vacuum vulnerability. The Exec_Command field in the shadow is processed by the…

AWS IoT Device Shadow IoT security Policy Misconfiguration

July 16, 2026