Description
The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.
Published: 2026-09-24
Score: 9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution during device pairing
Action: Immediate Patch
AI Analysis

Impact

The vulnerability permits an unauthenticated attacker to inject operating system commands while the device is pairing, enabling arbitrary code execution. If exploited, the attacker could gain full control over the device, compromising its confidentiality, integrity, and availability.

Affected Systems

The affected devices are the Eufy Omni C20 and the Eufy Omni X10 Pro. Firmware versions prior to 1.6.4 are vulnerable; users should confirm they are running 1.6.4 or later to avoid exploitation.

Risk and Exploitability

The CVSS score of 9 indicates high severity, and the lack of an EPSS score means exploitation probability is currently unknown. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely remote during the pairing process and requires no authentication, making it potentially attractive for attackers.

Generated by OpenCVE AI on September 25, 2026 at 03:54 UTC.

Remediation

Vendor Solution

Eufy recommends users to upgrade to version 1.6.4 or later.

OpenCVE Recommended Actions

  • Upgrade the device firmware to version 1.6.4 or later
  • Place the device on a separate network segment or sub‑network that isolates it from general user traffic
  • Configure network or firewall rules to restrict access to the device’s pairing port for unauthenticated clients

Generated by OpenCVE AI on September 25, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Eufy
Eufy omni C20
Eufy omni X10 Pro
Vendors & Products Eufy
Eufy omni C20
Eufy omni X10 Pro

Thu, 24 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Description The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.
Title OS command injection in Eufy Omni C20, Omni X10 Pro
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Eufy Omni C20 Omni X10 Pro
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-09-24T19:36:29.799Z

Reserved: 2026-09-17T16:04:33.101Z

Link: CVE-2026-93289

cve-icon Vulnrichment

Updated: 2026-09-24T19:36:26.011Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T20:17:34.137

Modified: 2026-09-24T21:25:27.050

Link: CVE-2026-93289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T14:15:51Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')