CVE-2026-105035

Published: Oct 15, 2026Modified: Oct 16, 2026Deferred

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: cve@takeonme.org (Secondary)

Description

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

Related CWEs

CWE-321

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

References (3)

https://github.com/xn0tsa/your-secrets-are-safe-with-me

Source: cve@takeonme.org

https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/

Source: cve@takeonme.org

https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Source: cve@takeonme.org

Timeline

No history available yet.