CVE-2026-105035High· 7.8▾ TwilightThe EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
FirmwareUpdater n/aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105032Critical· 9.1EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
CVE-2026-105038Critical· 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
CVE-2026-105034High· 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
CVE-2026-105033High· 8.8EnergizeLab AI Station Default Root Credentials with SSH Enabled
CVE-2026-105039Critical· 9.6EnergizeLab Station Middleware Admin APIs Missing Role Checks
CVE-2026-105037Critical· 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read