CVE-2026-105036

HIGH 7.5

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

CWE	CWE-494
Vendor	energizelab
Product	robot firmware (mode 104000)
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for energizelab robot firmware (mode 104000)

Be the first to know when new high vulnerabilities affecting energizelab robot firmware (mode 104000) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

EnergizeLab / Robot firmware (mode 104000)

v2.1_20260617182218_release

EnergizeLab / AI Station firmware (RK3562)

n/a

EnergizeLab / Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)

3.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xn0tsa/your-secrets-are-safe-with-me takeonme.org: https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/ theverge.com: https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Credits

Sammy Azdoufal todb of AHA!