These vulnerabilities collectively enable an unauthenticated, network-adjacent attacker to execute system-level commands, steal sensitive mapping data, or conduct man-in-the-middle attacks to achieve arbitrary code execution. Given that these devices are deployed globally in both home and IT environments, the potential impact includes unauthorized control over home automation hardware and potential pivot points into connected networks. Eufy has released firmware version 1.6.4 to address these security issues.

Impact

The successful exploitation of these vulnerabilities can lead to full device compromise, allowing an attacker to execute arbitrary system-level commands, monitor sensitive user data such as home mapping logs, and perform man-in-the-middle interceptions. These devices are used globally, and if left unpatched, they pose a significant risk to the integrity and confidentiality of the home or office network segment where they reside.

Recommendation

• Upgrade Eufy Omni C20 and Omni X10 Pro firmware to version 1.6.4 or later immediately.
• Isolate IoT devices on a dedicated, firewalled network segment separate from critical IT or business resources.
• Disable or restrict remote management and internet access for these devices unless explicitly required for operation.
• Implement VPN-only access for any necessary remote management tasks to reduce the attack surface.