CISA advisory covers three flaws in Eufy Omni C20 and Omni X10 Pro robot vacuums

What happened

CISA published an ICS advisory covering three vulnerabilities in Eufy robot vacuum products, the Omni C20 and the Omni X10 Pro [1]. According to the advisory, an attacker who exploits them could end up running commands at system level, or arbitrary code, on the affected device.

The three issues are tracked as CVE-2026-93289, CVE-2026-93290 and CVE-2026-93291 [1]. They are categorised under three weakness classes: OS command injection (CWE-78), use of hard-coded credentials, and improper certificate validation [1]. The vendor’s stated remediation is to move to version 1.6.4 or later [1]. The advisory text we have does not use the word “firmware” for that update, though that is the usual delivery mechanism for a device of this kind.

The advisory assigns a CVSS v3 base score of 9.4 to the advisory entry [1]. Our own severity metadata for this post shows no CVE data, because no matching NVD records were available to us at the time of writing. Treat the advisory’s score as the authoritative figure for now.

Nothing in the advisory indicates that any of these issues have been exploited in the wild, and we have no evidence that they have. The excerpt we worked from also contains no reporter credit and no disclosure timeline; the full advisory and its CSAF data may carry both.

Who is affected

CISA lists the affected versions as:

• Eufy Omni C20 below 1.6.4 — CVE-2026-93289, CVE-2026-93290, CVE-2026-93291
• Eufy Omni X10 Pro below 1.6.4 — CVE-2026-93289

On the face of the advisory, the X10 Pro is listed only against the command injection issue, while all three apply to the C20 [1]. The advisory does not explain why the scope differs, and it does not confirm whether the other two issues were assessed on the X10 Pro and ruled out, or simply not assessed. That distinction matters for anyone running X10 Pro hardware, so we have flagged it for follow-up rather than guessing.

Deployment is described as worldwide, the company headquarters location is given as China, and the advisory places the products in the Information Technology critical infrastructure sector [1]. In practice these are consumer devices, but they turn up in offices, labs, short-term rentals and home networks that also carry work traffic.

How it works

The advisory gives detail on only one of the three issues. CVE-2026-93289 is a command injection weakness: per CISA, no authentication is needed, and the pairing process is the point at which an attacker can get commands to run on the device [1].

Pairing is the point at which a device is joined to an account or a network, so this is the window in which the attack is possible as described. The advisory does not state whether an attacker needs to be on the same local network, within wireless range, or able to reach the device over the internet. Without that, the realistic attack surface is hard to size, and we are not going to infer it.

The other two CVEs are named in the advisory’s summary, and the weakness classes are listed — hard-coded credentials and improper certificate validation — but the excerpt available to us does not describe each one individually or map each CVE to its specific weakness [1]. Hard-coded credentials and weak certificate validation are both classes of issue that commonly affect how a device authenticates itself or verifies what it is talking to, but we are not going to speculate about the specific mechanism here.

What to do

• Update affected Eufy Omni C20 and Omni X10 Pro units to version 1.6.4 or later, which is the vendor’s stated remediation [1].
• Check the installed version in the Eufy mobile app rather than assuming the device has updated itself. The excerpt we have does not say whether updates are applied automatically; the full advisory may.
• Do not re-pair or factory-reset an unpatched device unnecessarily, since the one issue CISA describes in detail is reachable during pairing [1]. The exception is obvious but worth stating: if a device has to be paired to an account before it can receive 1.6.4, pair it, ideally on a network you control, and update it straight away.
• Put robot vacuums and similar appliances on a separate VLAN or guest SSID, away from workstations, servers and management interfaces. This limits what a compromised device can reach regardless of the specific flaw.
• If you manage a fleet or a shared space, inventory which units exist and who owns the associated account, so you can confirm coverage rather than hope for it.
• Read the full CISA advisory and its CSAF data for per-CVE detail beyond what is summarised here [1].