CVE-2026-105036: EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-16
Weakness: CWE-494

Description

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

Affected products

EnergizeLab AI Station firmware (RK3562): all versions
EnergizeLab Robot firmware (mode 104000): v2.1_20260617182218_release
EnergizeLab Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe): 3.1.2

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/
https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Get alerted when CVE-2026-105036 or the next vulnerability affects your stack