EnergizeLab
EnergizeLab Security Releases - October 2026
energizelab-2026-10 Oct 1, 2026 Source: Vendor
EnergizeLab security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-105032
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
9 lines
Showing 1–9 of 9
CVE-2026-105032
BR2026-0000-032865
FastAPI AI inference server
unclaimed
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An ...
Credited as Sammy Azdoufal
CVE-2026-105033
BR2026-0000-032866
AI Station firmware (RK3562)
unclaimed
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
Credited as Sammy Azdoufal
CVE-2026-105034
BR2026-0000-032867
NestJS auth service
unclaimed
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any ...
Credited as Sammy Azdoufal
CVE-2026-105035
BR2026-0000-032868
FirmwareUpdater
unclaimed
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can dec...
Credited as Sammy Azdoufal
CVE-2026-105036
BR2026-0000-032869
Robot firmware (mode 104000), AI Station firmware (RK3562), Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)
unclaimed
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify t...
Credited as Sammy Azdoufal
CVE-2026-105037
BR2026-0000-032870
station-middleware
unclaimed
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled fil...
Credited as Sammy Azdoufal
CVE-2026-105038
BR2026-0000-032871
FastAPI AI inference server
unclaimed
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model ...
Credited as Sammy Azdoufal
CVE-2026-105039
BR2026-0000-032872
station-middleware
unclaimed
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and chan...
Credited as Sammy Azdoufal
CVE-2026-105040
BR2026-0000-032873
NestJS auth service
unclaimed
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that a...
Credited as Sammy Azdoufal