Omni C20
Monthly
Improper TLS certificate validation in the eufy Omni C20 robot vacuum allows an attacker who has already obtained a man-in-the-middle position on the device's network path to present a forged certificate, hijack the connection, and ultimately execute arbitrary code on the device. The flaw carries a vendor/NVD CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), but the independent assessment re-rates it as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L because exploitation is unauthenticated and requires no user interaction yet is gated on a privileged network position - hostile or shared Wi-Fi, a rogue access point, or ARP/DNS spoofing on the LAN path - meaning a purely off-path remote attacker cannot trigger it. Reported through CISA ICS-CERT (ICSA-26-267-02); no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Devices that only ever connect to trusted, isolated home networks face substantially lower exposure than those on public, guest, or shared networks.
Command injection in the pairing process of eufy Omni C20 and Omni X10 Pro robot vacuums lets an unauthenticated attacker on an adjacent network or within wireless proximity run arbitrary system commands on the device during pairing. The vendor rates this CRITICAL at CVSS 4.0 9.0 (AV:A/AC:H/AT:P/PR:N/UI:N, all-high impact including subsequent-system impact), and CISA ICS published advisory ICSA-26-267-02; the practical bar is higher than the score suggests because the attacker must be radio/local-adjacent and catch the device inside an active pairing window. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).
Hard-coded credentials embedded in the Eufy Omni C20 robot vacuum (all versions per CPE cpe:2.3:a:eufy:omni_c20) let an attacker who can already read the device's log files recover those credentials and reuse them to reach information such as mapping data, resulting in a confidentiality-only exposure of the device's stored floor-plan content. The attack is strictly local and requires low privileges (CVSS 4.0 AV:L/PR:L/UI:N, assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), so there is no network attack path and no user interaction is needed once log access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV not applicable); the real-world risk is LOW-to-MODERATE and this is not a broad remote-exploitation priority, because the prerequisite of prior local log-read access is the primary limiting factor.
Improper TLS certificate validation in the eufy Omni C20 robot vacuum allows an attacker who has already obtained a man-in-the-middle position on the device's network path to present a forged certificate, hijack the connection, and ultimately execute arbitrary code on the device. The flaw carries a vendor/NVD CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), but the independent assessment re-rates it as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L because exploitation is unauthenticated and requires no user interaction yet is gated on a privileged network position - hostile or shared Wi-Fi, a rogue access point, or ARP/DNS spoofing on the LAN path - meaning a purely off-path remote attacker cannot trigger it. Reported through CISA ICS-CERT (ICSA-26-267-02); no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Devices that only ever connect to trusted, isolated home networks face substantially lower exposure than those on public, guest, or shared networks.
Command injection in the pairing process of eufy Omni C20 and Omni X10 Pro robot vacuums lets an unauthenticated attacker on an adjacent network or within wireless proximity run arbitrary system commands on the device during pairing. The vendor rates this CRITICAL at CVSS 4.0 9.0 (AV:A/AC:H/AT:P/PR:N/UI:N, all-high impact including subsequent-system impact), and CISA ICS published advisory ICSA-26-267-02; the practical bar is higher than the score suggests because the attacker must be radio/local-adjacent and catch the device inside an active pairing window. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).
Hard-coded credentials embedded in the Eufy Omni C20 robot vacuum (all versions per CPE cpe:2.3:a:eufy:omni_c20) let an attacker who can already read the device's log files recover those credentials and reuse them to reach information such as mapping data, resulting in a confidentiality-only exposure of the device's stored floor-plan content. The attack is strictly local and requires low privileges (CVSS 4.0 AV:L/PR:L/UI:N, assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), so there is no network attack path and no user interaction is needed once log access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV not applicable); the real-world risk is LOW-to-MODERATE and this is not a broad remote-exploitation priority, because the prerequisite of prior local log-read access is the primary limiting factor.