CVE-2026-105035

Deferred Deferred - Pending Action

Hard-Coded AES Key in EnergizeLab FirmwareUpdater

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Austin Hackers Anonymous

Description

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105035

Affected Vendors & Products

Vendor	Product	Version / Range
EnergizeLab	FirmwareUpdater	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

The vulnerability involves a hard-coded AES key in the EnergizeLab FirmwareUpdater. This key is shared across all installations, allowing an attacker who extracts it to decrypt firmware packages and forge malicious updates for any device using the updater.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the EnergizeLab FirmwareUpdater with the hard-coded AES key. Inspect the updater binary for the key or unusual firmware packages. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to install unauthorized firmware on your device, potentially gaining control, stealing data, or causing malfunctions. Since the key is shared, all users of the updater are at risk.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and integrity, such as GDPR (security of processing) and HIPAA (integrity of electronic protected health information). Unauthorized firmware changes could lead to data breaches or non-compliance penalties.

Mitigation Strategies

Immediately stop using the EnergizeLab FirmwareUpdater and replace it with a version that does not use a hard-coded AES key. Contact the vendor for an updated firmware updater that uses unique keys per installation.

Hi! I’m here to help you understand CVE-2026-105035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70