Omni C20 lacks proper certificate validation which could

#!/usr/bin/env python3
"""CVE-2026-93291 checker — Eufy Omni C20 / X10 Pro firmware version audit.
Scans local subnet for Eufy devices and checks firmware against fixed version 1.6.4.
Usage: python3 check_eufy_cve_2026_93291.py --subnet 192.168.1.0/24
Exit codes: 0=PATCHED/no devices, 1=VULNERABLE, 2=UNKNOWN
"""
import argparse
import ipaddress
import socket
import sys
import struct
import json
import re

FIXED_VERSION = (1, 6, 4)
TIMEOUT = 2
SSDP_ADDR = "239.255.255.250"
SSDP_PORT = 1900

def parse_version(ver_str):
    parts = re.findall(r'(\d+)', ver_str)
    if len(parts) >= 3:
        return tuple(int(p) for p in parts[:3])
    return None

def ssdp_discover(subnet):
    """Send SSDP M-SEARCH and look for Eufy devices."""
    msg = (
        'M-SEARCH * HTTP/1.1\r\n'
        'HOST: 239.255.255.250:1900\r\n'
        'MAN: "ssdp:discover"\r\n'
        'MX: 2\r\n'
        'ST: ssdp:all\r\n'
        '\r\n'
    )
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.settimeout(TIMEOUT + 1)
    sock.sendto(msg.encode(), (SSDP_ADDR, SSDP_PORT))
    devices = []
    try:
        while True:
            data, addr = sock.recvfrom(4096)
            response = data.decode('utf-8', errors='ignore').lower()
            if 'eufy' in response or 'anker' in response or 'omni' in response:
                devices.append({'ip': addr[0], 'response': data.decode('utf-8', errors='ignore')})
    except socket.timeout:
        pass
    sock.close()
    return devices

def check_device(device):
    """Parse SSDP response for firmware version info."""
    resp = device.get('response', '')
    ver_match = re.search(r'(?:firmware|fw|version)[:/\s]*(\d+\.\d+\.\d+)', resp, re.IGNORECASE)
    if ver_match:
        ver = parse_version(ver_match.group(1))
        if ver:
            return ver
    return None

def main():
    parser = argparse.ArgumentParser(description='CVE-2026-93291 Eufy Omni C20 checker')
    parser.add_argument('--subnet', default='192.168.1.0/24', help='Subnet to scan (default: 192.168.1.0/24)')
    args = parser.parse_args()
    
    print(f"[*] Scanning for Eufy devices via SSDP on {args.subnet}...")
    devices = ssdp_discover(args.subnet)
    
    if not devices:
        print("[*] No Eufy/Anker IoT devices found on this network segment.")
        print("[*] If you know Eufy Omni C20/X10 Pro devices are present, check firmware")
        print("    version manually in the Eufy Clean app: Settings > Device Info > Firmware.")
        print("    Fixed version: >= 1.6.4")
        print("")
        print("UNKNOWN — no Eufy devices detected via SSDP; verify manually.")
        sys.exit(2)
    
    vulnerable = False
    unknown = False
    
    for dev in devices:
        ip = dev['ip']
        ver = check_device(dev)
        if ver is None:
            print(f"[?] Eufy device at {ip} — firmware version not parseable from SSDP.")
            print(f"    Check manually in Eufy Clean app. Fixed version: >= 1.6.4")
            unknown = True
        elif ver < FIXED_VERSION:
            print(f"[!] VULNERABLE — Eufy device at {ip} running firmware {'.'.join(map(str, ver))} (< 1.6.4)")
            vulnerable = True
        else:
            print(f"[+] PATCHED — Eufy device at {ip} running firmware {'.'.join(map(str, ver))} (>= 1.6.4)")
    
    print("")
    if vulnerable:
        print("VULNERABLE — one or more Eufy devices need firmware update to >= 1.6.4.")
        sys.exit(1)
    elif unknown:
        print("UNKNOWN — could not determine firmware version for all devices.")
        sys.exit(2)
    else:
        print("PATCHED — all detected Eufy devices are on firmware >= 1.6.4.")
        sys.exit(0)

if __name__ == '__main__':
    main()