[ Vendor · 9 CVEs ]
EnergizeLab
CVEs affecting EnergizeLab published in the last 30 days, plus any EnergizeLab CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105035 | 15 Oct 2026 | CVSS 7.8 | EnergizeLab FirmwareUpdaterThe EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An… | |
| CVE-2026-105036 | 15 Oct 2026 | CVSS 7.5 | EnergizeLab Robot firmware (mode 104000)EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download… | |
| CVE-2026-105037 | 15 Oct 2026 | CVSS 9.9 | EnergizeLab station-middlewareEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from… | |
| CVE-2026-105038 | 15 Oct 2026 | CVSS 9.8 | EnergizeLab FastAPI AI inference serverThe EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An… | |
| CVE-2026-105039 | 15 Oct 2026 | CVSS 9.6 | EnergizeLab station-middlewareEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated… | |
| CVE-2026-105040 | 15 Oct 2026 | CVSS 8.8 | EnergizeLab NestJS auth serviceThe EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set… | |
| CVE-2026-105032 | 15 Oct 2026 | CVSS 9.1 | EnergizeLab FastAPI AI inference serverThe EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication… | |
| CVE-2026-105033 | 15 Oct 2026 | CVSS 8.8 | EnergizeLab AI Station firmware (RK3562)The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device… | |
| CVE-2026-105034 | 15 Oct 2026 | CVSS 8.2 | EnergizeLab NestJS auth serviceThe EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote… |