CVE-2026-105035: CWE-321 Use of Hard-coded Cryptographic Key in EnergizeLab FirmwareUpdater
Description
CVE-2026-105035 is a high-severity vulnerability in the EnergizeLab FirmwareUpdater where a single hard-coded AES cryptographic key is used across all installations. This key can be extracted by an attacker, enabling them to decrypt and forge firmware packages for any device that trusts the updater. The vulnerability affects the FirmwareUpdater binary distributed as an AArch64 ELF in the CDN bin.zip. No specific affected versions or patches are provided.
CVSS v3.1
Score 7.8high
Affected software
EnergizeLab
FirmwareUpdater
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The EnergizeLab FirmwareUpdater contains a hard-coded AES key shared by all installations, violating secure cryptographic key management practices (CWE-321). An attacker who obtains this key can decrypt firmware packages and create forged firmware updates that will be accepted by devices relying on this updater. This compromises confidentiality, integrity, and availability of the firmware update process. The CVSS v3.1 score is 7.8 (high), reflecting local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker who recovers the hard-coded AES key can decrypt sensitive firmware packages and forge malicious firmware updates. This can lead to full compromise of affected devices by installing unauthorized firmware, impacting confidentiality, integrity, and availability of the device firmware.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the FirmwareUpdater binary and monitor for unauthorized firmware modifications. Consider isolating devices from untrusted networks to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AHA
- Date Reserved
- 2026-10-02T21:30:55.242Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad13fda2cdf04f6565c562a
Added to database: 10/15/2026, 21:04:26 UTC
Last enriched: 10/15/2026, 21:18:29 UTC
Last updated: 10/15/2026, 21:18:29 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.