CVE-2026-105033: high-severity vulnerability in EnergizeLab AI Station firmware (RK3562)
EnergizeLab AI Station Default Root Credentials with SSH Enabled
Published
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
exploitation probability
—
observed exploitation
nono source reports it
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
EnergizeLab · AI Station firmware (RK3562)Related CVEs — EnergizeLab AI Station firmware (RK3562)
In the same product, most dangerous first.
References
https://github.com/xn0tsa/your-secrets-are-safe-with-mehttps://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001110111111110111111111111000000000000000000000000000000000000000000000000000001101/https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab