Is CVE-2026-93289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93289 being exploited in the wild.

How severe is CVE-2026-93289?

High severity, with a CVSS score of 7.5, published 24 September 2026.

Which products and versions are affected?

Eufy Omni C20 <1.6.4; Eufy Omni X10 Pro <1.6.4.

Is there a fix for CVE-2026-93289?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93289 attacked?

It is attacked from the adjacent network or with local access or over the network, in a network appliance.

Am I affected by CVE-2026-93289?

Check whether you run Eufy Omni C20 or Eufy Omni X10 Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93289: Eufy Omni C20 and X10 Pro OS command injection and certificate validation

Q: Which products and versions are affected?

Eufy Omni C20 <1.6.4; Eufy Omni X10 Pro <1.6.4.

Q: Is there a fix for CVE-2026-93289?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-93289 attacked?

It is attacked from the adjacent network or with local access or over the network, in a network appliance.

Q: Am I affected by CVE-2026-93289?

Check whether you run Eufy Omni C20 or Eufy Omni X10 Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93289 · Severity: high · CVSS 7.5 · Published 2026-09-24

Eufy's Omni C20 and Omni X10 Pro are home/office security camera systems that manage surveillance, mapping data, and device connectivity. These products contain multiple critical vulnerabilities allowing attackers to execute arbitrary system commands, bypass certificate validation for man-in-the-middle attacks, and access sensitive credentials. An attacker could gain full control of the device, intercept communications, or access stored mapping data without authentication.

Technologies: Eufy Omni C20. Vendors: Eufy.

Quick answers

Is CVE-2026-93289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93289 being exploited in the wild.
How severe is CVE-2026-93289?: High severity, with a CVSS score of 7.5, published 24 September 2026.
Which products and versions are affected?: Eufy Omni C20 <1.6.4; Eufy Omni X10 Pro <1.6.4.
Is there a fix for CVE-2026-93289?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93289 attacked?: It is attacked from the adjacent network or with local access or over the network, in a network appliance.
Am I affected by CVE-2026-93289?: Check whether you run Eufy Omni C20 or Eufy Omni X10 Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The advisory covers three distinct vulnerabilities: CVE-2026-93289 is an OS command injection flaw (CWE-78) exploitable during the device pairing process that allows unauthenticated command execution with CVSS 3.1 base score 7.5 and CVSS 4.0 score 9.0. CVE-2026-93290 involves hard-coded credentials (CWE-798) in Omni C20 that permit local authenticated attackers to extract credentials and access mapping data. CVE-2026-93291 reflects improper certificate validation (CWE-295) enabling network-based man-in-the-middle attacks to execute arbitrary code (CVSS 3.1: 9.4, CVSS 4.0: 9.3). All vulnerabilities affect Omni C20 versions prior to 1.6.4; CVE-2026-93289 also affects Omni X10 Pro. The primary attack vectors are adjacent network for command injection, local access for credential abuse, and network-based for certificate validation bypass. Eufy recommends upgrading to version 1.6.4 or later; no active exploitation has been reported.

Affected products

Eufy Omni C20 <1.6.4
Eufy Omni X10 Pro <1.6.4

Identifiers

CVE-2026-93289
CVE-2026-93290
CVE-2026-93291

Timeline

2026-09-24: disclosed: CISA advisory ICSA-26-267-02 published

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.