# CVE-2026-93290: Eufy Omni C20 hard-coded credentials in log files

Source: https://junglewise.ai/threats/cve-2026-93290-omni-c20-uses-hard-coded-credentials-that-could-allow-an-attacker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93290 · Severity: medium · CVSS 5.5 · Published 2026-09-24

The Eufy Omni C20 security camera system contains hard-coded credentials that can be exposed through log file monitoring, allowing attackers with local access to extract additional credentials and access sensitive mapping data. An attacker exploiting this vulnerability could gain unauthorized access to system information and potentially control critical functions of the surveillance device. This affects organizations and consumers relying on Omni C20 for security monitoring.

Technologies: [Eufy Omni C20](https://junglewise.ai/threats/technologies/omni-c20). Vendors: [Eufy](https://junglewise.ai/threats/vendors/eufy).

## Quick answers

**Is CVE-2026-93290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93290 being exploited in the wild.

**How severe is CVE-2026-93290?** Medium severity, with a CVSS score of 5.5, published 24 September 2026.

**Which products and versions are affected?** Eufy Omni C20 before 1.6.4.

**Is there a fix for CVE-2026-93290?** A patch was published on 2026-09-24: Version 1.6.4 addresses this vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93290 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-93290?** Check whether you run Eufy Omni C20 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from the use of hard-coded credentials (CWE-798) in the Omni C20 system that can be discovered by monitoring log files. The attack requires local access and low privilege (non-administrative) user rights on the device. Successful exploitation allows an attacker to obtain credentials for accessing sensitive information such as mapping data, potentially leading to further system compromise. A patch is available in version 1.6.4 and later.

## Affected products

- Eufy Omni C20 before 1.6.4

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: patched: Version 1.6.4 addresses this vulnerability

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02)

## Related threats

- [Eufy Omni C20 improper certificate validation in SSL/TLS](https://junglewise.ai/threats/cve-2026-93291-omni-c20-lacks-proper-certificate-validation-which-could-allow-an)
- [Eufy Omni C20 and X10 Pro OS command injection and certificate validation](https://junglewise.ai/threats/cve-2026-93289-eufy-omni-c20-and-x10-pro-os-command-injection-and-certificate)