CVE-2026-105036

7.5 Élevée

Publiée le 15/10/2026 à 23:17 · Modifiée le 16/10/2026 à 22:17 · Analyse NVD reportée · Source : cve@takeonme.org

Description

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

Traduire en français

Produits concernés

EnergizeLab Robot firmware (mode 104000)
EnergizeLab AI Station firmware (RK3562)
EnergizeLab Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	cve@takeonme.org	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-494

Références

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories