CVE-2026-93291: Improper certificate validation in Eufy Omni C20
Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eufy Omni C20to a version that resolves this vulnerability.Fixed in 1.6.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Eufy Omni C20 devices are exposed because the affected product does not properly validate certificates. The network attack vector and lack of required privileges or user interaction indicate that an attacker does not need prior access to the device or user action to attempt exploitation.
What does an attacker need to exploit it?
An attacker needs the ability to conduct a man-in-the-middle attack against communications involving the Omni C20. Successful interception or manipulation of improperly validated certificate traffic could lead to arbitrary code execution.
What is the potential impact of successful exploitation?
A successful attacker may execute arbitrary code on the affected Omni C20. The supplied vector also indicates high confidentiality and integrity impact, with low availability impact.