CVE-2026-105034
8.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-287, CWE-306
Impact
Unauthenticated remote attackers can impersonate any robot device against cloud backend services. They only need network access to the authentication service and a target robot serial number.
Root cause
The NestJS auth service fails to authenticate requests before issuing device tokens for supplied serial numbers.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Fix & remediation
Apply vendor backend updates for the EnergizeLab NestJS auth service to enforce authentication on token issuance endpoints. As an interim mitigation, place the auth service behind an API gateway enforcing authentication or restrict network access to trusted clients.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.