CVE-2026-932899.0CriticalCWE-78

CVE-2026-93289: OS command injection in Eufy Omni C20, Omni X10 Pro

Eufy · Omni C20

Vendor fix available · Affected: Eufy Omni C20 · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.8%probability of exploitation in the next 30 days

56th percentile

050100

Higher than 56% of scored CVEs

9.0CriticalCVSS 4.0

LowMediumHighCrit.

DescriptionNVD

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: OS Command Injection · Command and Code Injection
Vendor: Eufy
Published: September 2026
Band: Unlikely (under 1%), September 2026

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 24 Sep.

Full timeline

Quiet for 7 weekslast report 25 Sep2 articles2 outlets

First report
Article
Official notice
Running total

Show as table

2 articles about CVE-2026-93289 from 2 outlets
Published (UTC)	Outlet	Headline
24 Sep 16:13	CISA	CISA Warns Robot Vacuums Could Enable Arbitrary Code Execution
25 Sep 03:47	SecurityOnline	CISA Warns Eufy Robot Vacuum Flaws Could Enable Code Execution

25 Sep 03:47
CISA Warns Eufy Robot Vacuum Flaws Could Enable Code Execution
SecurityOnline · mentions it in passing
24 Sep 16:13
CISA Warns Robot Vacuums Could Enable Arbitrary Code Execution
CISA · official notice · first in our coverage

New articles also arrive in the RSS feed.