eufy Omni C20 CVE-2026-93291

Exploitation requires the attacker to hold a man-in-the-middle position on the network path used by the eufy Omni C20 (e.g., shared/hostile Wi-Fi, rogue access point, or ARP/DNS spoofing on the LAN) so that a forged TLS certificate can be presented; because the device performs improper certificate validation, it accepts the malicious connection. No authentication or user interaction is required (PR:N/UI:N), but the MITM network-positioning requirement is the key limiting factor - a purely remote off-path attacker cannot trigger this. Devices operating only on trusted, isolated home networks face substantially lower exposure than those on public or shared networks.

The vendor/NVD CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) rates this Critical, but that vector is internally inconsistent with the described exploitation path: the flaw is improper TLS certificate validation that must be leveraged via a man-in-the-middle attack, which realistically requires the attacker to occupy a privileged network position (compromised/hostile Wi-Fi, ARP/DNS spoofing, rogue AP). That precondition warrants AC:H rather than AC:L, so the effective real-world risk is lower than the 9.3 headline suggests. There is no EPSS score, no CISA KEV listing, and no public POC, so exploitation is speculative rather than demonstrated - no active exploitation signal exists. The reporting through ICS-CERT/CISA lends credibility to the technical finding, and RCE-via-MITM on an IoT device is a genuine impact, but the MITM prerequisite makes this a targeted, opportunistic-network risk rather than a wormable internet-facing threat. Bottom line: real but conditional - prioritize patching for devices on untrusted networks, but the raw 9.3 overstates likelihood of mass exploitation.

An attacker who can position themselves in the network path between the eufy Omni C20 and its cloud/update endpoint (e.g., a malicious Wi-Fi hotspot or a compromised LAN) presents a forged TLS certificate that the device fails to validate. The device accepts the attacker-controlled connection and processes malicious data - such as a tampered firmware or update payload - resulting in arbitrary code execution on the device. No public exploit code is currently available.