Affected versions and potential consequences

CISA initially released its advisory on September 24, 2026. At that time, the agency said it had received no reports of known public exploitation specifically targeting these vulnerabilities. That statement concerns reports reaching CISA; it does not establish that the vulnerabilities have never been exploited.

According to CISA, Eufy Omni C20 and Omni X10 Pro versions below 1.6.4 are affected by a command injection vulnerability. The agency says an attacker who has not authenticated could execute system commands during pairing. This makes the pairing process a specific condition of the reported flaw. CISA lists the products as deployed worldwide, so its affected-product description is not confined to one country.

For Omni C20, CISA also describes a vulnerability involving credentials built into the product. The agency says an attacker could obtain credentials by monitoring log files and then use them to access information such as mapping data. This identifies a potential information-access consequence alongside the command-execution risk.

Certificate risk and CISA’s defensive advice

CISA identifies a further Omni C20 vulnerability involving inadequate certificate validation. According to the agency, that weakness could enable a man-in-the-middle attack and potentially allow arbitrary code execution. Its affected-version entry for this flaw names Omni C20 below 1.6.4; it does not extend that entry to Omni X10 Pro.

CISA recommends defensive measures to reduce the risk of exploitation. Its network-exposure advice is framed around control system devices and systems: minimize their exposure and keep them inaccessible from the internet. The recommendation addresses limiting exposure; it does not describe a product-specific repair for the vulnerabilities outlined in the advisory.

The agency also recommends placing control system networks and remote devices behind firewalls and separating them from business networks. Where remote access is necessary, it recommends more secure methods such as virtual private networks. CISA cautions that VPNs can themselves have vulnerabilities, should be kept current, and depend for their security on the devices connected to them.

Sources & context

  1. Eufy Omni C20, Omni X10 Pro | CISACISA

    Single-source report; claims attributed to the source, not independently verified. Source feed date (published): 2026-09-24T12:00:00.000Z. Study date: not established. Consulted: 2026-10-01T15:19:01.100Z.

AI assisted with preparing and checking this article. The responsible editor accepted this version for publication following an assisted review of facts, sources and attribution.

Related reading