by Kastro
Paper/Archive/CVE-2026-93289

CVE-2026-93289

Eufy Omni C20 — OS command injection in Eufy Omni C20, Omni X10 Pro

EPSS 0.7%CVSS 9.0
critical.is priorityof 100
38
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 52.5.525 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

Affected

ProductAffectedFixed inSource
Omni C20< 1.4.61.4.6CNA
Omni X10 Pro< 3.1.363.1.36CNA

Scores by source

icscert (CNA)9.0CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
icscert (CNA)7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-26-267-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-02.json