High severity · published Oct 15, 2026
CVE-2026-105033
EnergizeLab AI Station Default Root Credentials with SSH Enabled
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
AI Station firmware (RK3562) · EnergizeLab
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105033
github.com
https://github.com/xn0tsa/your-secrets-are-safe-with-me
takeonme.org
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001110111111110111111111111000000000000000000000000000000000000000000000000000001101/
www.theverge.com
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
More from AI Station firmware (RK3562)
7.5
CVE-2026-105036
EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks