← Back to Feed

Eufy Omni C20, Omni X10 Pro

CVE-2026-93289CVE-2026-93290CVE-2026-93291

September 24, 2026 · CISA (US-CERT) · Severity: CRITICAL

This advisory describes three vulnerabilities in Eufy Omni C20 and Omni X10 Pro robot vacuums, including command injection, hard-coded credentials, and improper certificate validation. Successful exploitation could allow an attacker to execute arbitrary code or run system-level commands. Eufy recommends upgrading to version 1.6.4 or later to mitigate these risks. 📌 **Analyst Note:** These vulnerabilities in consumer IoT devices highlight the ongoing challenge of securing embedded systems with hard-coded credentials and weak authentication. Users should apply the firmware update immediately to prevent remote compromise.

Key Takeaways

  • The Eufy Omni C20 and Omni X10 Pro robot vacuums are vulnerable to command injection attacks that could allow an unauthenticated attacker to execute system commands during the pairing process.
  • The Omni C20 also uses hard-coded credentials that could be extracted from log files, potentially allowing an attacker to access sensitive information like mapping data.
  • Additionally, improper certificate validation in the Omni C20 could enable an attacker to intercept communications, further compromising the device's security.
☕ Buy a Coffee