Omni X10 Pro
Monthly
Command injection in the pairing process of eufy Omni C20 and Omni X10 Pro robot vacuums lets an unauthenticated attacker on an adjacent network or within wireless proximity run arbitrary system commands on the device during pairing. The vendor rates this CRITICAL at CVSS 4.0 9.0 (AV:A/AC:H/AT:P/PR:N/UI:N, all-high impact including subsequent-system impact), and CISA ICS published advisory ICSA-26-267-02; the practical bar is higher than the score suggests because the attacker must be radio/local-adjacent and catch the device inside an active pairing window. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).
Command injection in the pairing process of eufy Omni C20 and Omni X10 Pro robot vacuums lets an unauthenticated attacker on an adjacent network or within wireless proximity run arbitrary system commands on the device during pairing. The vendor rates this CRITICAL at CVSS 4.0 9.0 (AV:A/AC:H/AT:P/PR:N/UI:N, all-high impact including subsequent-system impact), and CISA ICS published advisory ICSA-26-267-02; the practical bar is higher than the score suggests because the attacker must be radio/local-adjacent and catch the device inside an active pairing window. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).