The Eufy Omni C20 device contains hard-coded credentials (CWE-798) that are stored in a manner accessible via log files. An attacker with local privileges could monitor these logs to obtain the credentials, which may then be used to access sensitive information including mapping data. The vulnerability requires local access and low privileges but no user interaction. It affects versions prior to 1.6.4. There is no indication of known exploits in the wild or available patches at this time.

An attacker with local access and low privileges could extract hard-coded credentials from log files, potentially gaining unauthorized access to sensitive information such as mapping data. This could lead to privacy breaches or unauthorized monitoring. The vulnerability does not allow remote exploitation or privilege escalation by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the device and monitor for unauthorized physical or local access attempts. Avoid exposing log files to untrusted users.