High severity · published Oct 15, 2026
CVE-2026-105035
EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FirmwareUpdater · EnergizeLab
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105035
github.com
https://github.com/xn0tsa/your-secrets-are-safe-with-me
takeonme.org
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/
www.theverge.com
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab