CVE-2026-105034

8.2 Élevée

Publiée le 15/10/2026 à 23:17 · Modifiée le 16/10/2026 à 22:17 · Analyse NVD reportée · Source : cve@takeonme.org

Description

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

Traduire en français

Produits concernés

EnergizeLab NestJS auth service

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	cve@takeonme.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-287
CWE-306

Références

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories