What’s Vulnerable › Vulnerabilities

CVE-2026-105033: EnergizeLab AI Station Default Root Credentials with SSH Enabled

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-798

Description

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

Affected products

• EnergizeLab AI Station firmware (RK3562): all versions

References

• https://github.com/xn0tsa/your-secrets-are-safe-with-me
• https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001110111111110111111111111000000000000000000000000000000000000000000000000000001101/
• https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Get alerted when CVE-2026-105033 or the next vulnerability affects your stack