High severity · published Oct 15, 2026
CVE-2026-105036
EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
AI Station firmware (RK3562) · EnergizeLab
All versions, or not specified · source: vendor
RF
Robot firmware (mode 104000) · EnergizeLab
v2.1_20260617182218_release · source: vendor
WD
Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe) · EnergizeLab
3.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105036
github.com
https://github.com/xn0tsa/your-secrets-are-safe-with-me
takeonme.org
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/
www.theverge.com
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab
More from AI Station firmware (RK3562)
8.8
CVE-2026-105033
EnergizeLab AI Station Default Root Credentials with SSH Enabled