CVE-2026-93291

Deferred Deferred - Pending Action

Omni C20 Certificate Validation Bypass Leads to MITM Arbitrary Code Execution

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: ICS-CERT

Description

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-93291

EUVD

EUVD-2026-86413

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

Omni C20 has a flaw where it does not properly validate certificates. This allows attackers to intercept communications through a man-in-the-middle attack. Such attacks could enable the execution of arbitrary code on the affected system.

Impact Analysis

This vulnerability could allow attackers to steal sensitive data, manipulate system operations, or install malware. It may lead to unauthorized access, data breaches, or system compromise, depending on the system's use and environment.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to potential data breaches or unauthorized access. Organizations may face legal penalties, reputational damage, and loss of trust if such incidents occur.

Mitigation Strategies

Disable or replace the Omni C20 device until a patch is available. Monitor network traffic for unusual activity that may indicate a man-in-the-middle attack. Ensure all communications are encrypted and certificates are properly validated.

Hi! I’m here to help you understand CVE-2026-93291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70