CISA revised its advisory ICSA-26-267-02 on Eufy robot vacuums on 27 October 2026. Update A changes the affected versions and the fix. The original advisory from 24 September told owners of both the Omni C20 and the Omni X10 Pro to install version 1.6.4. The revised one gives a separate fixed version for each model and narrows which flaws affect the X10 Pro.

The three flaws

The vulnerabilities were reported to CISA by Jared of Somerset Recon. All three affect the Omni C20:

  • CVE-2026-93289: OS command injection during the pairing process. An unauthenticated attacker can run system commands. The attacker has to be on an adjacent network, for example within Wi-Fi range or on the same network segment. CVSS v4 score: 9.0.
  • CVE-2026-93290: hard-coded credentials. According to CISA, an attacker who can read the log files can obtain credentials and access data such as the cleaning maps. This needs local access. CVSS v4: 6.8.
  • CVE-2026-93291: missing certificate validation. An attacker in a man-in-the-middle position can intercept the connection and run arbitrary code. CVSS v4: 9.3, the highest of the three.

What Update A changed

The September version listed both models as affected below 1.6.4, with all three CVEs and the same fix. CISA's machine-readable CSAF file from that release confirms it. The summary of the revised advisory says:

  • Omni C20: affected below 1.4.6, all three CVEs. Update to 1.4.6 or later.
  • Omni X10 Pro: affected below 3.1.36, only CVE-2026-93289 (the pairing command injection). Update to 3.1.36.

The revision is not fully consistent: in the detailed sections, the X10 Pro still appears as affected under the other two CVEs. The fixed versions are the same in both places, though. Anyone who compared their robot's firmware with "1.6.4" in September may have reached the wrong conclusion.

What owners should do

Check the firmware version in the Eufy Clean app and update if it is older than 1.4.6 (C20) or 3.1.36 (X10 Pro). CISA says no public exploitation of these flaws has been reported to it. Its general advice comes from industrial security practice: keep the device off the open internet and behind a firewall. In a home that mostly means keeping the router and Wi-Fi password secure. The pairing flaw needs an attacker nearby, not on the other side of the world.

Neither CISA nor the advisory says whether Eufy has published release notes for these versions. Neither does it say whether other Omni models share the code.