{"id":"CVE-2026-93289","aliases":[],"cve":{"records":[{"id":"CVE-2026-93289","source":"icscert","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T16:04:33.101Z","published":"2026-09-24T19:24:40.244Z","modified":"2026-10-30T17:10:40.924Z"}],"publishers":[{"name":"icscert","role":"CNA","organizationId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","modified":"2026-10-30T17:10:40.924Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-24T19:36:29.799Z"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","tags":[],"source":"icscert"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-02.json","tags":[],"source":"icscert"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","source":"icscert"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-24T19:36:22.263773Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"OS command injection in Eufy Omni C20, Omni X10 Pro","titleSource":"icscert","descriptionSource":"icscert","description":"The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.","score":9,"severity":"critical","published":"2026-09-24T19:24:40.244Z","modified":"2026-10-30T17:10:40.924Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Eufy","name":"Omni C20","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.4.6","versionType":"custom"},{"version":"1.4.6","status":"unaffected"}],"defaultStatus":"unaffected","cpes":[],"source":"icscert","url":"https://www.cve.org/CVERecord?id=CVE-2026-93289"},{"vendor":"Eufy","name":"Omni X10 Pro","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.1.36","versionType":"custom"},{"version":"3.1.36","status":"unaffected"}],"defaultStatus":"unaffected","cpes":[],"source":"icscert","url":"https://www.cve.org/CVERecord?id=CVE-2026-93289"}],"remediation":[{"text":"Eufy recommends users to upgrade to version 1.4.6 or later for Omni C20 and version 3.1.36 for Omni X10 Pro.","source":"icscert","url":"https://www.cve.org/CVERecord?id=CVE-2026-93289"}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-02.json"],"sources":[{"name":"CVE","id":"CVE-2026-93289","modified":"2026-10-30T17:10:40.924Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93289"}],"assessments":[{"source":"icscert","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9},{"source":"icscert","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:56:21.618Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:50:32.984Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Eufy Omni C20 and Omni X10 Pro devices are vulnerable to OS command injection attacks during pairing, potentially allowing unauthenticated attackers to execute system commands. Affected versions are Omni C20 below 1.4.6 and Omni X10 Pro below 3.1.36.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T13:11:08.072Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93289"}]}}