Eufy Omni C20, Omni X10 Pro
CISA warns Eufy Omni C20 and X10 Pro versions before 1.6.4 have command injection and certificate flaws.
CISA published ICS advisory ICSA-26-267-02 for Eufy Omni C20 and Omni X10 Pro devices before version 1.6.4. CVE-2026-93289 allows unauthenticated OS command injection during pairing on both models, with CVSS 4.0 scored 9.0. Omni C20 also has hard-coded credentials (CVE-2026-93290) and improper certificate validation that could allow man-in-the-middle arbitrary code execution (CVE-2026-93291, CVSS 3.1 9.4). Somerset Recon reported the issues, and CISA knows of no public exploitation.
- CVE-2026-93289 allows unauthenticated command injection during pairing.
- CVE-2026-93290 hard-coded credentials can leak Omni C20 mapping data.
- CVE-2026-93291 weak certificates enable man-in-the-middle code execution.
- Both products need version 1.6.4 or newer; no known exploitation.
- Vendors
- Eufy
- Products
- Omni C20Omni X10 Pro
- Organizations
- CISASomerset Recon
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-93289+1 related CVE | Unauthenticated Command Injection in Eufy Omni C20 and Omni X10 Pro Vacuums | 9.0 group max | — | ||
| CVE-2026-93291 | Man-in-the-Middle Certificate Validation Flaw in Eufy Omni C20 Enables Code Execution | 9.3 | — |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. The following versions of Eufy Omni C20, Omni X10 Pro are affected: Omni C20 <1. 6.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.