Eufy Omni C20 CVE-2026-93290

Requires local access with low privileges (AV:L/PR:L): the attacker must be able to read the Omni C20's log files, where the hard-coded credentials are exposed. There is no network attack path and no user interaction (UI:N). Exploitation is limited to obtaining and reusing the embedded credentials to access data such as mapping information; impact is confined to confidentiality (no integrity or availability effect). The practical prerequisite - prior local/log-read access to the device - is the primary limiting factor that keeps real-world risk below the raw score.

Real-world risk is LOW-to-MODERATE and this is not a broad remote-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VC:H, base 6.8) makes the key limitation explicit: exploitation is LOCAL and requires existing low privileges - the attacker must already be able to read the device's log files, not reach it over the network. Impact is confidentiality-only (VI:N/VA:N), scoped to sensitive data such as home mapping/floor-plan information rather than device control or code execution. There is no EPSS score, no CISA KEV listing, and no public POC, so there is no evidence of active or automated exploitation - this is a hard-coded-credential hygiene flaw (CWE-798), not a wormable network bug. Note a tagging discrepancy: the input Tags label this 'Authentication Bypass,' but the description and CWE-798 describe credential exposure via log monitoring leading to information disclosure, not a classic auth bypass. The 6.8 score is driven by VC:H (high confidentiality impact) offset by the local vector and required privileges; treat as a privacy/data-exposure issue on a consumer robot vacuum rather than an urgent enterprise patch item.

A low-privileged actor with local or logical access to the Omni C20 (e.g., a co-resident, someone with app/companion access, or an attacker who has already gained a foothold on the device or its host) monitors the device log files, which leak the hard-coded credentials. Using those credentials they authenticate and read sensitive data such as the home mapping data. No public exploit code has been identified at time of analysis; exploitation is manual and requires the local, low-privilege preconditions from the CVSS vector.