Skip to content
OpenAdvisories
Critical ICSA-26-267-02 3 CVEs

Eufy Omni C20, Omni X10 Pro (Update A)

Published Sep 24, 2026 · Updated Oct 27, 2026 · Revision 2

Vendor: Eufy Product: Omni C20 Product: Omni X10 Pro

Summary

Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code.

Vulnerabilities 3

  • Critical 9.4
    CVE-2026-93291

    Improper certificate validation in Eufy Omni C20

    Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

    Eufy Omni C20
  • High 7.5
    CVE-2026-93289

    OS command injection in Eufy Omni C20, Omni X10 Pro

    The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

    Eufy Omni C20 Omni X10 Pro
  • Medium 5.5
    CVE-2026-93290

    Use of Hard-coded Credentials in Eufy Omni C20

    Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data.

    Eufy Omni C20

Revision history

  1. #2

    Update A - Updated affected versions and the Mitigation section

  2. #1

    Initial Publication

References