CVE-2026-105035
7.8HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-321
Impact
Attackers can decrypt and forge firmware packages for targeted devices. They need to extract the static key from the updater binary and trick a user or system into installing the modified payload.
Root cause
The FirmwareUpdater binary embeds a single hard-coded AES key shared across all installations instead of using unique keys or asymmetric signature verification.
Affected systems
EnergizeLab FirmwareUpdater (AArch64 ELF distributed via CDN bin.zip); versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
No patched version is specified in the data. Do not use the affected FirmwareUpdater binary, block untrusted firmware images, and stop distributing bin.zip from your CDN until a version using asymmetric signature validation is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.