CVE-2026-105036 debrief: EnergizeLab firmware updates downloaded without integrity checks. The EnergizeLab AI Station firmware, EilikO Linux robot firmware, and Windows desktop app download firmware updates over plain HTTP without verifying their integrity or authenticity. This oversight allows an attacker to intercept or modify the traffic and substitute a malicious update, potentially compromising devic [truncated]
CVE-2026-105035 EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key. The EnergizeLab FirmwareUpdater uses a single hard-coded AES key shared by all installations, allowing an attacker to decrypt and forge firmware packages for any device that trusts it. Defenders should assess exposure and prioritize remediation to prevent potential security breaches. This issue requires immediate attention to ensure [truncated]
CVE-2026-105034 debrief: EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers. The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication, allowing unauthenticated remote attackers to obtain valid device tokens. This vulnerability has a high severity with a CVSS score of 8.2 and could lead to unauthorized access [truncated]
CVE-2026-105033 EnergizeLab AI Station Default Root Credentials with SSH Enabled: The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled, allowing an attacker with network access to log in as root and take full control of the device. This vulnerability has a high CVSS score of 8.8, indicating a high severity. The CVE record and source item provide details ab [truncated]
CVE-2026-105032 EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write. The EnergizeLab Eilik and EilikO AI skill upload endpoint does not require authentication and does not constrain uploaded file paths, allowing unauthenticated remote attackers to write arbitrary files using path traversal. This vulnerability affects EnergizeLab Eilik and EilikO robots, AI inference serve [truncated]
