CISA 2026-09-24

Eufy Omni C20, Omni X10 Pro

Machine-generated analysis · WAYSCloud LLM

Versions earlier than 1.6.4 of the Eufy Omni C20 and Omni X10 Pro are vulnerable to command injection and hard-coded credentials.

Context

The advisory covers the Eufy Omni C20 and Omni X10 Pro devices. Firmware versions prior to 1.6.4 are affected by CVE-2026-93289 (unauthenticated command injection during pairing) and CVE-2026-93290 (hard-coded credentials that could expose log files). The products are listed as deployed worldwide in the information-technology sector. Eufy recommends upgrading to firmware version 1.6.4 or later.

Operator considerations

Check: Verify the installed firmware version is earlier than 1.6.4.
Patch: Apply the firmware update to version 1.6.4 or later as provided by Eufy.
Log: Monitor pairing process logs for unexpected command execution attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code.

The following versions of Eufy Omni C20, Omni X10 Pro are affected:

Omni C20

Read the full advisory on CISA →