Eufy recommends upgrading firmware to version 1.6.4 or later. CISA advises minimizing network exposure for devices, ensuring they are not internet-accessible, placing them behind firewalls segregated from business networks, and using updated VPNs for remote access.
Quick answers
What is CVE-2026-93290?
Eufy recommends upgrading firmware to version 1.6.4 or later. CISA advises minimizing network exposure for devices, ensuring they are not internet-accessible, placing them behind firewalls segregated from business networks, and using updated VPNs for remote access.
How severe is CVE-2026-93290?
critical, CVSS 9.3
Is CVE-2026-93290 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-93290 be mitigated?
Eufy recommends upgrading firmware to version 1.6.4 or later. CISA advises minimizing network exposure for devices, ensuring they are not internet-accessible, placing them behind firewalls segregated from business networks, and using updated VPNs for remote access.
CVSS
9.3
Vendor
Eufy
Published
Sep 30, 2026 · 08:42
Patch
Unknown / not confirmed
Affected products
Eufy Omni C20, Eufy Omni X10 Pro
Mitigation
Eufy recommends upgrading firmware to version 1.6.4 or later. CISA advises minimizing network exposure for devices, ensuring they are not internet-accessible, placing them behind firewalls segregated from business networks, and using updated VPNs for remote access.
CISA has issued advisory ICSA-26-267-02 detailing multiple security vulnerabilities in Eufy Omni C20 and Omni X10 Pro robot vacuums. The flaws, affecting firmware versions below 1.6.4, include an unauthenticated command injection vulnerability, hard-coded credentials enabling credential exposure, and improper certificate validation susceptible to man-in-the-middle attacks. Eufy recommends upgrading to firmware 1.6.4 or later to mitigate the risks.