CVE-2026-105036highCWE-494

CVE-2026-105036: falha de alta gravidade em EnergizeLab AI Station firmware (RK3562)

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

Publicada em

18Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
EnergizeLab · AI Station firmware (RK3562)EnergizeLab · Robot firmware (mode 104000)EnergizeLab · Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)
CVEs relacionadas — EnergizeLab AI Station firmware (RK3562)

No mesmo produto, das mais perigosas para as menos.

CVE-2026-105033HIGHEnergizeLab AI Station Default Root Credentials with SSH EnabledEPSS —
Referências
https://github.com/xn0tsa/your-secrets-are-safe-with-mehttps://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab