Eufy Omni C20 and X10 Pro Firmware Update Addresses Three Vulnerabilities

Quick Answer

Eufy recommends firmware 1.6.4 or later for the affected Omni C20 and Omni X10 Pro models. CISA's CVE records confirm a pairing-time command-injection flaw in both; the hard-coded-credential and certificate-validation flaws are listed only for Omni C20. Do not extend this model list to every Eufy device.

Last verified: October 2, 2026 UTC using CISA-authored CVE records. The advisory web page could not be retrieved; no robot or app was tested.

Scope And Authority

Product scope	Eufy Omni C20 and Omni X10 Pro robot vacuums before firmware 1.6.4
Advisory	ICSA-26-267-02
CVEs	CVE-2026-93289, CVE-2026-93290, CVE-2026-93291
Authoritative release date	2026-09-24; CISA CVE records published that day. Exact advisory time not reconfirmed.
Authority revision date	CISA CNA/ADP records updated 2026-09-24; advisory HTML revision could not be reread on October 2.
Affected versions	Eufy Omni C20 and Omni X10 Pro firmware versions earlier than 1.6.4; CVE-2026-93290 and CVE-2026-93291 are listed only for Omni C20.
Fixed version	Eufy firmware 1.6.4 or later
CVSS base score	5.5 / 7.5 / 9.4 (official CVSS v3.1)
CVSS severity	Medium to Critical
Exploitation status	CISA ADP recorded exploitation as none for these CVEs on September 24, 2026. This dated assessment does not establish that no later exploitation occurred.

What Changed

CVE-2026-93289 concerns unauthenticated command injection during pairing and has a CVSS v3.1 score of 7.5. CVE-2026-93290 concerns hard-coded credentials that can expose information such as mapping data, scored 5.5. CVE-2026-93291 concerns certificate validation and a man-in-the-middle path to code execution, scored 9.4. CISA also publishes v4.0 scores; the numbers in this notice are explicitly v3.1.

What To Validate Now

1. Identify the robot. Record model, device identifier and firmware, keeping account credentials and home maps out of public tickets.
2. Use the supported firmware path. Apply Eufy's available fixed firmware for that model. If no qualifying update is offered, ask Eufy support; do not install another model's image.
3. Verify the running version. Reopen device details after the update and confirm the resulting firmware. Preserve existing pairing and maps rather than resetting or re-pairing solely for this check.
4. Check normal operation. In an appropriate supervised area, test existing app control, a normal cleaning task and required cloud connectivity. Pair only when actually needed, on a trusted network; do not reproduce an injection or intercept cloud traffic.
5. Retain device evidence. Save redacted version readback and test outcomes. Network separation reduces exposure but does not replace firmware correction or establish that previously disclosed data was recovered.

Operational Cautions

Perform impact analysis before deploying defensive measures, preserve device configuration where supported, keep the device powered and connected during the approved update, and do not interpret the critical score as confirmation of exploitation.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• Review/update timestamps, device model, supported-app firmware readback and any vendor support case; do not record account passwords or home maps.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• ICSA-26-267-02

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.