Critical OS Command Injection (CVE‑2026‑93289/93290/93291) in Eufy Omni C20 & Omni X10 Pro Enables Remote Code Execution
What It Is – The U.S. Cybersecurity & Infrastructure Security Agency (CISA) issued an advisory (ICS‑A‑26‑267‑02) identifying three critical‑severity vulnerabilities in the firmware of Eufy Omni C20 and Omni X10 Pro devices (versions < 1.6.4). The flaws include OS command injection, hard‑coded credentials, and improper certificate validation, allowing an unauthenticated attacker to execute arbitrary system commands during the device‑pairing process.
Exploitability – The vulnerabilities are publicly disclosed, have a CVSS v3 base score of 9.4, and can be exploited without authentication. No public exploit code has been released, but the severity and ease of exploitation warrant immediate remediation.
Affected Products – Eufy Omni C20 < 1.6.4 and Omni X10 Pro < 1.6.4 (consumer‑grade smart‑home security hubs).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a secure configuration and patch‑management control that provides continuous evidence of firmware version compliance across deployed assets.
- Highlights the importance of credential hygiene (eliminating hard‑coded secrets) as a control objective that maps to multiple frameworks (e.g., NIST CSF, ISO 27001).
- Supports a defensible audit trail: documenting timely upgrades and verification of certificate handling shows due diligence to regulators and enterprise buyers.
Recommended Actions
- Upgrade all Omni C20 and X10 Pro devices to firmware 1.6.4 or later immediately.
- Verify that device certificates are validated correctly after the upgrade.
- Integrate automated firmware‑version monitoring into your asset‑inventory system to capture continuous compliance evidence.
- Record remediation steps in your control‑evidence repository to support audit readiness.
Source: CISA Advisory – ICS‑A‑26‑267‑02