CVE-2026-93289

Eufy Omni C20 and Omni X10 Pro robot vacuums are vulnerable to an operating system command injection flaw (CWE-78) in the device pairing process. An unauthenticated attacker within adjacent network range can inject and execute arbitrary system commands on the vacuum's embedded operating system while the device is being paired with its mobile app, without needing credentials or user interaction. Successful exploitation gives the attacker full control of the device (high impact to confidentiality, integrity, and availability, including follow-on effects such as potential pivoting to the local network or abuse of cloud-linked functions). The attack vector is adjacent (same network/radio range) with high attack complexity and requires the device to be in pairing mode, which limits opportunistic attacks to setup or re-pairing windows — but during those windows any nearby attacker can strike. Only owners of these two specific Eufy models are affected; exploitation status is none known (no public PoC, not in CISA KEV).

What to do: Update the firmware on Omni C20 and Omni X10 Pro units via the Eufy app as soon as the vendor releases a fix, and check the ICS-CERT advisory for the exact patched versions. Perform initial pairing or re-pairing only on a trusted home network, never on shared/public Wi-Fi or in dense living environments where an attacker could be in radio range, and don't leave the device sitting in pairing mode. If a device was ever paired in an untrusted location, factory-reset it, update firmware, and re-pair at home; watch for anomalous behavior such as unexpected camera/microphone activity or the unit operating while idle.