All vulnerabilities
CVE-2026-93289

OS command injection in Eufy Omni C20, Omni X10 Pro

Eufy Omni C20
Open in ThreatlineRecord JSON
CVSS
9.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.68%Chance of exploitation activity in the next 30 days, higher than 51% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.6.4Fixed versionCVE List
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

Text from CVE List

Affected versions 2

  • Omni C20affected: all versions before 1.6.4CVE List
  • Omni X10 Proaffected: all versions before 1.6.4CVE List

References 1