# CISA flags security flaws in Eufy Omni C20 and X10 Pro Omni robots

Three vulnerabilities could let an attacker run code on the robot vacuums. Eufy says firmware 1.6.4 or later fixes them.

Published 2026-09-24T12:00:00-04:00. HTML version: https://robotsforthat.com/news/cisa-eufy-omni-c20-x10-pro-omni-security-flaws/

## What it means for you

If you own an Eufy Omni C20 or X10 Pro Omni, check that the firmware is 1.6.4 or later in the eufy Clean app and turn on automatic updates. CISA says no attacks using these flaws have been reported. Putting smart home devices on a separate guest network adds another layer.

The US Cybersecurity and Infrastructure Security Agency published advisory ICSA-26-267-02 on September 24, 2026, covering three vulnerabilities in two Eufy robot vacuums: the Omni C20 and the Omni X10 Pro, sold as the X10 Pro Omni.

The most serious, CVE-2026-93291, is a missing certificate check that could let an attacker in a man-in-the-middle position run code. It scores 9.4 out of 10 on the CVSS 3.1 scale. A second flaw, CVE-2026-93289, allows command injection without a login during Wi-Fi pairing, but the attacker has to be on a nearby network. A third, CVE-2026-93290, involves hard-coded credentials in log files that could expose mapping data to someone with local access.

According to the advisory text mirrored by Assurant, the pairing flaw affects both models below version 1.6.4, while the other two list version ranges only for the Omni C20. BetterBuyBase credits a researcher from Somerset Recon.

Eufy's fix is firmware 1.6.4 or later. CISA says no public exploitation has been reported to it, and BetterBuyBase found no published proof-of-concept code. How many robots have installed the update is not known.

BetterBuyBase notes a catch for X10 Pro Omni owners: the app may show version numbers starting with 2, which makes it unclear whether the fix is included. Its advice is to leave the robot docked on stable 2.4 GHz Wi-Fi so updates can install, and to recheck after any re-pairing.

Neither model is on our floor rankings. Eufy's Omni S2, which robotsforthat lists at $1,599.99, is not named in the advisory.

## Sources

1. [Eufy Omni C20, Omni X10 Pro: CISA ICSA-26-267-02 (Assurant mirror)](https://www.assurantcyber.com/blog/icsa-26-267-02/)
2. [eufy Robot Vacuum Vulnerability: Omni C20 and X10 Pro Omni (BetterBuyBase)](https://betterbuybase.com/eufy-robot-vacuum-vulnerability)