Eufy Patches Three Bugs That Let a Vacuum Be Hijacked

Eufy fixed three vulnerabilities in its Omni C20 and Omni X10 Pro robot vacuums, including a command-injection flaw an unauthenticated attacker can trigger during device pairing, the Cybersecurity and Infrastructure Security Agency said in an advisory published Sept. 24.

Security researcher Jared of Somerset Recon reported all three bugs to CISA. The most severe, CVE-2026-93291, stems from the Omni C20 failing to properly validate a certificate; CISA rated it 9.4 out of 10 on the CVSS 3.1 scale and said it lets an attacker carry out a man-in-the-middle attack that results in arbitrary code execution.

What each of the three bugs does

CVE-2026-93289 is a command-injection flaw, rated 7.5, that an unauthenticated attacker can trigger during the pairing process on both the Omni C20 and Omni X10 Pro to run system-level commands, according to CISA's advisory. CVE-2026-93290, rated 5.5, is a hard-coded credential in the Omni C20 that lets an attacker who can monitor its log files recover credentials used to reach stored data such as the robot's floor maps. CVE-2026-93291, the certificate-validation flaw, applies only to the Omni C20 and carries the advisory's highest score.

CVE	Bug	CVSS 3.1	Product
CVE-2026-93289	Command injection during pairing	7.5	Omni C20, Omni X10 Pro
CVE-2026-93290	Hard-coded credentials	5.5	Omni C20
CVE-2026-93291	Improper certificate validation	9.4	Omni C20

Why a vacuum's certificate check matters

The Omni C20 navigates with an internal laser sensor and infrared sensors rather than a camera, according to a Vacuum Wars review updated Sept. 18, building a multi-level map of a home's floor plan that it reports back to Eufy's app. CVE-2026-93291 means an attacker positioned on the same network, or able to intercept its traffic, can bypass the certificate check the device uses to confirm it is really talking to Eufy's servers, then use that position to run their own code on the vacuum. CVE-2026-93290's hard-coded credentials extend the exposure to the maps themselves: an attacker who can read the device's log files, without touching the certificate flaw at all, can pull the floor plan and other stored data straight out. The floor maps a compromised Omni C20 exposes sit in the same category of quiet privacy risk as a Windows side-channel flaw published Sept. 25, where an unrelated bug let a local app infer which websites someone had open; both turn something mundane, a device log or a notification API, into a record of what a person is actually doing at home.

The fix, and what is still unconfirmed

Eufy's fix for all three bugs is version 1.6.4 or later, which CISA's advisory says the company recommends installing directly, since the devices do not appear to update themselves the way a phone does. Daily CyberSecurity, which covered the advisory the same day, said no public proof-of-concept exploit code has been published and CISA has confirmed no exploitation of the flaws in the wild. Eufy has not said how many Omni C20 or X10 Pro units remain on the vulnerable firmware. It is the second ICS advisory in three days naming a specific consumer vendor rather than a generic device category, following CISA's Sept. 24 addition of WSO2 and Adobe Commerce bugs to its separate exploited-vulnerabilities catalog. Firmware 1.6.4 is the specific build anyone still running an older version needs to install by hand; a robot vacuum on a home network rarely gets the same admin attention a router does.