CVE-2026-105036

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

State: Published
Severity: 7.5 High
Published: Oct 15, 2026
Updated: Oct 16, 2026
Reserved: Oct 2, 2026

Description

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	AHA

Weaknesses

CWE-494 Download of Code Without Integrity Check

Affected Products

Product	Versions
Robot firmware (mode 104000)EnergizeLab	v2.1_20260617182218_releaseAffected
AI Station firmware (RK3562)EnergizeLab	n/aAffected
Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)EnergizeLab	3.1.2Affected

References

https://github.com/xn0tsa/your-secrets-are-safe-with-metechnical-description
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/third-party-advisory
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-labmedia-coverage

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.