CVE-2026-105035

7.8 HIGHpublic exploit available

Published 2026-10-15 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-321

Public exploit & PoC references

https://github.com/xn0tsa/your-secrets-are-safe-with-me

All references

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100413PoC
LOWCVE-2026-102241PoC
HIGHCVE-2026-103055PoC
MEDIUMCVE-2026-103778
HIGHCVE-2026-105392PoC
MEDIUMCVE-2026-106172
UNSCOREDCVE-2026-107171
HIGHCVE-2026-10764

Related by shared AI tags and CWE weakness class. Browse the full archive.