‹ Back to list

CVE-2026-105035

Status: DeferredHigh (7.8)—
Severity7.8High · CVSS 3.1
Exploitation probability0.20 %higher than 9% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

CVSS

Base score
7.8
Version
3.1
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.20 %
Percentile among all scored CVEs
9
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector AV:L/UI:R/PR:N exige interacción del usuario y la descripción indica una clave AES hardcodeada en FirmwareUpdater que permite descifrar y falsificar paquetes de firmware.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Password PoliciesUser TrainingRestrict File and Directory PermissionsPrivileged Account ManagementMulti-factor AuthenticationCredential Access Protection

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Energizelab — FirmwareupdaterAI

CWEs

References

Show 3 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-105035",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "cve@takeonme.org",
        "ssvcData": {
          "role": "CNA",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-105035",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T19:51:40.337516Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@takeonme.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@takeonme.org",
      "affectedData": [
        {
          "vendor": "EnergizeLab",
          "product": "FirmwareUpdater",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-15T21:17:04.113",
  "references": [
    {
      "url": "https://github.com/xn0tsa/your-secrets-are-safe-with-me",
      "source": "cve@takeonme.org"
    },
    {
      "url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/",
      "source": "cve@takeonme.org"
    },
    {
      "url": "https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab",
      "source": "cve@takeonme.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@takeonme.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it."
    }
  ],
  "lastModified": "2026-10-16T20:17:18.030",
  "sourceIdentifier": "cve@takeonme.org"
}