CVE-2026-105036
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-494
Impact
Attackers can achieve full compromise and replace firmware on targeted devices. They need adjacent network access or the ability to intercept unencrypted traffic to perform a man-in-the-middle attack during updates.
Root cause
The update mechanism downloads firmware over cleartext HTTP without performing any cryptographic signature or integrity verification.
Affected systems
EnergizeLab AI Station firmware (versions not specified), EilikO Linux robot firmware v2.1_20260617182218_release, and EnergizeLab Windows desktop app 3.1.2.
CVSS v3.1 · CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed versions are listed. Disallow or block outbound HTTP update traffic from these devices at the network firewall, isolate them onto a restricted VLAN, and do not trigger updates until a vendor patch with HTTPS and signature checks is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.