CVE-2026-93289

HIGH 7.5

OS command injection in Eufy Omni C20, Omni X10 Pro

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

CWE	CWE-78
Vendor	eufy
Product	omni c20
Published	Sep 24, 2026
Last Updated	Sep 24, 2026

Stay Ahead of the Next One

Get instant alerts for eufy omni c20

Be the first to know when new high vulnerabilities affecting eufy omni c20 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Eufy / Omni C20

0 < 1.6.4

Eufy / Omni X10 Pro

0 < 1.6.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02

Credits

Jared of Somerset Recon reported these vulnerabilities to CISA.