Critical Vulnerabilities Affect Eufy Robot Vacuum Firmware

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-267-02 on September 24, 2026, warning of multiple vulnerabilities in Eufy Omni C20 and Omni X10 Pro robot vacuum devices. The affected products run firmware versions earlier than 1.6.4.

Three distinct vulnerabilities were identified:
- CVE-2026-93289: An unauthenticated command injection flaw that could allow an attacker to execute system commands during the pairing process. This vulnerability carries a CVSS 4.0 base score of 9.0, rated CRITICAL.
- CVE-2026-93290: A hard-coded credentials issue in the Omni C20 model. This flaw could allow an attacker to monitor log files and obtain credentials, potentially accessing mapping data. The CVSS 4.0 base score is 6.8, rated MEDIUM.
- CVE-2026-93291: An improper certificate validation flaw affecting both Omni C20 and Omni X10 Pro. This could enable a man-in-the-middle attack, potentially allowing arbitrary code execution. The CVSS 4.0 base score is 9.3, rated CRITICAL.

The vendor, Eufy (a subsidiary of Anker), has recommended that users upgrade to firmware version 1.6.4 or later to address the flaws. The vulnerabilities were reported to CISA by Jared of Somerset Recon.

CISA's defensive guidance emphasizes minimizing network exposure for control system devices, ensuring they are not accessible from the internet, and locating devices behind firewalls isolated from business networks. When remote access is required, CISA advises using Virtual Private Networks (VPNs) kept up to date.