Eufy Omni C20, Omni X10 Pro: 3 CVEs, Critical 9.4
Summary
CISA reports 3 vulnerabilities in Eufy Omni C20, Omni X10 Pro. Weakness types: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Use of Hard-coded Credentials, Improper Certificate Validation. Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. Highest CVSS v3 score: 9.4 (Critical), exploitable over the network.
At a glance
- Vendor
- Eufy
- Products
- Omni C20, Omni X10 Pro
- CVEs
- CVE-2026-93289, CVE-2026-93290, CVE-2026-93291
- Highest CVSS v3
- 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Information Technology
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-93289 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 7.5 | – | No | The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process. |
| CVE-2026-93290 | Use of Hard-coded Credentials | 5.5 | – | No | Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data. |
| CVE-2026-93291 | Improper Certificate Validation | 9.4 | – | No | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code. |
Affected products (2)
- Eufy Omni C20: <1.6.4
- Eufy Omni X10 Pro: <1.6.4
Vendor fixes and mitigations (from advisory)
- Mitigation: Eufy recommends users to upgrade to version 1.6.4 or later.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.