The Omni C20 firmware contains hard‑coded user credentials that an attacker can discover by reading log files on the device. Based on the description, it is inferred that an attacker capable of accessing the log files could retrieve these credentials. Once the credentials are obtained, the attacker can authenticate to the device’s management interface and view sensitive information such as mapping data and camera configuration. This flaw aligns with the CWE‑798 class of hard‑coded passwords and enables unauthorized access to data normally protected behind authentication.

Eufy’s Omni C20 home‑security cameras running firmware versions older than 1.6.4 are affected. The vulnerability is present in all units that ship with the default firmware package before the 1.6.4 release.

The CVSS base score of 6.8 reflects a medium‑severity risk, with no full‑remote code execution. The EPSS score is not publicly available, and the flaw is not listed in the CISA KEV catalog, indicating that no widespread public exploitation has been reported. Based on the description, the likely attack vector involves an attacker who can reach the device over the network or physically connect to it, allowing them to read log files and obtain the hard‑coded credentials. Nevertheless, an attacker who can reach the device over the network or physically connect to it can exploit the hard‑coded credentials without requiring advanced skills, making the risk tangible for owners of exposed devices.