CVE-2026-105036

Deferred Deferred - Pending Action

Firmware Update Hijack in EnergizeLab AI Station

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Austin Hackers Anonymous

Description

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105036

Affected Vendors & Products

Vendor	Product	Version / Range
EnergizeLab	Robot	firmware (mode 104000) v2.1_20260617182218_release
EnergizeLab	AI	Station firmware (RK3562) n/a
EnergizeLab	Windows	desktop app (EnergizeLabSetup-3.1.2-Win.exe) 3.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

This vulnerability involves firmware and software updates for EnergizeLab AI Station, EilikO Linux robot firmware, and EnergizeLab Windows desktop app being downloaded over plain HTTP without integrity or authenticity verification. An attacker can intercept or modify the traffic to replace the update with a malicious version.

Detection Guidance

To detect this vulnerability, monitor network traffic for firmware update requests to unencrypted HTTP endpoints. Check if devices or apps are downloading updates without HTTPS. Use packet sniffers like Wireshark or tcpdump to inspect traffic for plain HTTP requests to update servers.

Impact Analysis

An attacker could gain control of your device by replacing legitimate updates with malicious ones. This could lead to unauthorized access, data theft, or device manipulation. Users of affected EnergizeLab products are at risk if they update over unsecured networks.

Compliance Impact

This vulnerability may violate compliance requirements for secure data handling and integrity, such as GDPR's data protection principles or HIPAA's security rules, due to the lack of secure update mechanisms exposing systems to potential breaches.

Mitigation Strategies

Immediately block HTTP firmware update traffic on your network. Switch to HTTPS-only update servers if available. Contact the vendor for secure update channels. Disable automatic updates if they use HTTP until patches are verified.

Hi! I’m here to help you understand CVE-2026-105036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70