Read the docs
TI-2026-62908 Aliases CVE-2026-93289GHSA-9vx9-rfcq-648m

OS command injection in Eufy Omni C20, Omni X10 Pro

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Fix Fixed Omni C20 (Eufy): 1.4.6Omni X10 Pro (Eufy): 3.1.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EufyOmni C20before 1.4.61.4.6Patch availableCNA
EufyOmni X10 Probefore 3.1.363.1.36Patch availableCNA
  • Omni C20 VendorEufy Affected before 1.4.6 Fixed in 1.4.6 Patch available CNA
  • Omni X10 Pro VendorEufy Affected before 3.1.36 Fixed in 3.1.36 Patch available CNA

Remediation

  • Fix · CNA Omni C20 (Eufy) Fixed in 1.4.6
  • Fix · CNA Omni X10 Pro (Eufy) Fixed in 3.1.36

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Eufy Omni C20 1.4.6

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-62910 Improper certificate validation in Eufy Omni C20Priority MEDIUM 48
    • TI-2026-62909 Use of Hard-coded Credentials in Eufy Omni C20Priority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93289
  2. 2026-10-03 Alias added: GHSA-9vx9-rfcq-648m
  3. 2026-10-30 Fix available: Eufy/Omni [email protected], Eufy/Omni X10 [email protected] · CNA
  4. 2026-10-30 Affected versions changed · CNA
  5. 2026-10-30 1 new reference · CNA

References

Other 2

  • TI-2026-62910 Improper certificate validation in Eufy Omni C20 CVSS 4.0CRITICAL 9.3
  • TI-2021-02508 Buffer overflow in Eufy Indoor 2K Indoor Camera CVSS 3.1HIGH 8.8
  • TI-2023-19279 The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network… CVSS 3.1HIGH 8.2
  • TI-2026-62909 Use of Hard-coded Credentials in Eufy Omni C20 CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences