Eufy Omni C20 / X10 Pro
From Wiki-IoT
| Eufy Omni C20 / X10 Pro | ||
|---|---|---|
|
Security Grade
Calculator v
|
Eufy Omni C20 / Omni X10 Pro Robot Vacuum
Brand: Eufy (Parent: Anker Innovations) Category: Robot Vacuum • Model / Gen: Omni C20 / X10 Pro C20 / X10 Pro Release Date: 2024-01-01 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper mechanism reported. |
| Known vulnerabilities | Very common | 🔗 Proof | OS Command Injection (CVSS 9.4), Hard-coded Credentials, Improper Certificate Validation. |
| Prior attacks | Rare | 🔗 Proof | No confirmed active exploitation in the wild at time of advisory. |
| Updatability | Very common | 🔗 Proof | Firmware 1.6.4 or later patches the vulnerabilities. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Pairing process lacks authentication, enabling command injection. |
| Communications | No encryption | 🔗 Proof | Improper certificate validation allows MITM attacks (CVE-2026-93291). |
| Storage | No encryption | 🔗 Proof | Hard-coded credentials expose log files and mapping data (CVE-2026-93290). |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Basic account management exists but pairing is unauthenticated. |
| Authentication | Absent | 🔗 Proof | Unauthenticated attacker can execute system commands during pairing. Brute-force protection |
| Brute-force protection | Absent | 🔗 Proof | No brute-force protection reported for pairing/API services. |
| Event logging | Partial logging | 🔗 Proof | Log files can be monitored to obtain hard-coded credentials. Passwords |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Hard-coded credentials used in Omni C20 (CVE-2026-93290). |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Embedded Linux (Companion App: Eufy Clean App) |
| Hardware (CPU / GPU) | CPU: Unknown (Embedded SoC) • GPU: None |
| Memory & Storage | Memory: Unknown • Storage: Internal Flash |
| Power, Battery & Charging | Battery: Built-in Lithium-ion Battery • Power: Charging Dock • Charging: Auto-recharge via Dock |
| Display & Camera | Display: None • Camera: Built-in Camera (for navigation/obstacle avoidance) |
| Sound & Connectivity | Sound: Built-in Speaker (Voice Assistant) • Connectivity: Wi-Fi (2.4GHz) |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
