CVE-2026-105036: CWE-494 Download of Code Without Integrity Check in EnergizeLab Robot firmware (mode 104000)

CVE-2026-105036 describes a vulnerability in EnergizeLab Robot firmware (mode 104000) and associated software where firmware updates are downloaded over plain HTTP without integrity or authenticity verification. This lack of security controls enables an attacker with network access to perform man-in-the-middle attacks, replacing legitimate firmware updates with malicious ones. The affected software includes EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and EnergizeLab Windows desktop app version 3.1.2.

Successful exploitation allows an attacker to deliver and install malicious firmware updates on the robot devices or associated software, potentially leading to full compromise of confidentiality, integrity, and availability of the affected systems. The CVSS v3.1 score of 7.5 (high) reflects the high impact on confidentiality, integrity, and availability, although the attack complexity is high and requires network access.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted networks for firmware updates and consider network-level protections to prevent interception or modification of update traffic.