CVE-2026-105032Critical· 9.1▾ MidnightThe EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
fastapi_ai_inference_server n/aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105038Critical· 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
CVE-2026-105035High· 7.8EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
CVE-2026-105034High· 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
CVE-2026-105033High· 8.8EnergizeLab AI Station Default Root Credentials with SSH Enabled
CVE-2026-105039Critical· 9.6EnergizeLab Station Middleware Admin APIs Missing Role Checks
CVE-2026-105037Critical· 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read